Stored Cross-Site Scripting Vulnerability in Webling Plugin for WordPress

CVE-2026-1263

What is CVE-2026-1263?

The Webling plugin for WordPress is susceptible to Stored Cross-Site Scripting vulnerability across all versions up to and including 3.9.0. This arises due to inadequate input validation, insufficient output escaping, and a lack of capability checks in the functions responsible for saving forms and member lists. Authenticated attackers with Subscriber-level permissions or higher can exploit this flaw to inject malicious scripts into Webling forms and member lists. These scripts will execute whenever an administrator accesses the affected areas in the WordPress admin panel, posing significant security risks to the integrity of the site.

References