SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-81404

HIGH · CVSS 7.1 EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-09-05 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The IPGP Visitors Origin WordPress plugin prior to version 1.6 is vulnerable to reflected Cross-Site Scripting (XSS) due to inadequate sanitization of user input in HTTP responses. This flaw allows unauthenticated attackers to execute malicious scripts in the context of users who unknowingly submit crafted requests. WordPress site administrators using this plugin should prioritize updating to mitigate potential exploitation risks.

CVE
CVE-2026-81404
Severity
HIGH
CVSS
7.1
EPSS
0.20%
WordPress

Original NVD Description

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.