Cross-Site Scripting Flaw in Orphans Plugin by WordPress
CVE-2026-125791

7.1HIGH

Key Information:

Vendor

WordPress
Status
Orphans
Vendor
CVE Published:
15 November 2026

What is CVE-2026-125791?

The Orphans plugin for WordPress is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises from improper handling of input during web page generation, enabling attackers to inject malicious scripts that may be executed in the context of users visiting the affected application. This vulnerability impacts versions of the Orphans plugin up to and including 3.4.6, potentially exposing users to unauthorized actions and data theft.

Affected Version(s)

Orphans 0 <= 3.4.6

References

https://patchstack.com/database/wordpress/plugin/sierotki...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

peppa | Patchstack Bug Bounty Program
.