blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-81742

HIGH 8.8 CVSS 3.1
Published
September 12, 2026
Last modified
September 14, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.

Affected products and versions

  • Unknown BE REST Endpoints — Up to and including 1.0.0

References

  • wpscan.com https://wpscan.com/vulnerability/ea7c371a-3d0b-4e09-9c76-145345ad316b/
  • nvd.nist.gov Official NVD record