Reflected Cross-Site Scripting Vulnerability in Rognone Plugin for WordPress
CVE-2026-1450

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Rognone
Vendor
CVE Published:
2 June 2026

What is CVE-2026-1450?

The Rognone plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit insufficient input sanitization in the 'mode' parameter. This flaw enables attackers to inject arbitrary web scripts into pages, which can execute malicious actions if a user is tricked into clicking a deceptive link. This presents significant security risks, particularly in WordPress environments where the Rognone plugin is in use.

Affected Version(s)

rognone 0 <= 0.6.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/rognone/trunk/...
https://plugins.trac.wordpress.org/browser/rognone/tags/0...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

san6051
.