Cross-Site Scripting Vulnerability in MCB WordPress Plugin
CVE-2026-110525
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110525?
The MCB WordPress plugin prior to version 1.0.0 is vulnerable due to improper sanitization and escaping of request header values. This flaw allows unauthenticated users to inject malicious JavaScript code, which can then execute within the browser sessions of administrators viewing the statistics page. Such an exploit can lead to unauthorized actions and compromise sensitive data, making it crucial for WordPress site owners to update and ensure the security of their installations.
Affected Version(s)
MCB 0 <= 1.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.