Cross Site Scripting Vulnerability in Parallax Section Block Plugin for WordPress
CVE-2026-102378

7.1HIGH

Key Information:

Vendor

WordPress
Status
Parallax Section Block
Vendor
CVE Published:
1 October 2026

What is CVE-2026-102378?

The Parallax Section block plugin for WordPress, up to version 2.0.4, is susceptible to Unauthenticated Cross Site Scripting (XSS) attacks. This vulnerability allows malicious actors to inject rogue scripts into web pages viewed by unsuspecting users, potentially leading to information theft, session hijacking, or other forms of cyber exploitation. Maintaining plugin updates and implementing proper security measures is imperative to safeguard against such vulnerabilities.

Affected Version(s)

Parallax Section block <= 2.0.4

References

https://patchstack.com/database/wordpress/plugin/parallax...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Asim Alshaya | Patchstack Bug Bounty Program
.