blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-110525

HIGH 8.8 CVSS 3.1
Published
November 6, 2026
Last modified
November 6, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

Affected products and versions

  • Unknown MCB — Up to and including 1.0.0

References

  • wpscan.com https://wpscan.com/vulnerability/4be75329-7348-4e4a-a541-6c53256d92eb/
  • nvd.nist.gov Official NVD record