- Versiones afectadas: ≤ 3.5
- Corregido en: aún sin corrección publicada
- CVE: CVE-2026-24600
- Publicado:
Aún no se ha publicado ninguna corrección.
8 versiones de este repositorio están afectadas: 3.5, 3.4, 3.3, 3.2.1, 3.1, 3.0, 2.9, 2.7
Detalles
The Penci Review plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Solución: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
CWE-79: Improper Neutralization of Input During Web Page Generation