Stored Cross-Site Scripting in DesignSetGo Plugin for WordPress

CVE-2026-111068

What is CVE-2026-111068?

The DesignSetGo plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access and higher to perform Stored Cross-Site Scripting by leveraging the 'tagName' parameter. This issue arises from inadequate input sanitization and output escaping practices. By exploiting this flaw, attackers can inject malicious scripts into pages that will execute when a legitimate user accesses an affected page. Successful exploitation involves an administrator triggering the plugin's block-conversion migration function, known as 'Scan & Convert Blocks', which activates the exploit by turning a hidden payload into executable content in post HTML. It requires specific actions from the administrator to activate the vulnerability, preventing the attacker from executing it independently.

References