Stored Cross-Site Scripting Vulnerability in Ortto Plugin for WordPress

CVE-2026-113409

What is CVE-2026-113409?

The Ortto plugin for WordPress prior to version 1.0.25 is susceptible to a stored cross-site scripting vulnerability. This flaw arises from the plugin's failure to properly escape stored settings on its administration settings page. Attackers with the ability to modify the plugin's configuration can potentially inject and execute arbitrary JavaScript within the context of an administrator's session when they visit the affected settings page. This security oversight can lead to significant risks, including the unauthorized access and manipulation of sensitive data.

References