Stored Cross-Site Scripting Vulnerability in OTP Login & Register Woocommerce Plugin for WordPress

CVE-2026-12402

What is CVE-2026-12402?

The OTP Login & Register Woocommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping in the 'fb-config' settings. This vulnerability can allow authenticated attackers, with administrator-level access, to inject malicious scripts into pages, which can then execute whenever users visit those pages. On multisite environments lacking the unfiltered_html capability, this flaw poses a significant risk to network super administrators, facilitating potential exploitation across the WordPress network.

References