Stored Cross-Site Scripting Vulnerability in White Label CMS Plugin for WordPress

CVE-2026-11898

What is CVE-2026-11898?

The White Label CMS plugin is susceptible to a Stored Cross-Site Scripting vulnerability caused by inadequate input sanitization and output escaping within its admin settings. This flaw allows authenticated attackers with administrator-level permissions to inject malicious web scripts that can execute when a user accesses the compromised pages. The vulnerability primarily affects multi-site installations and those where unfiltered_html capability is disabled, highlighting the need for meticulous security practices to protect against potential exploitation.

References