Reflected Cross-Site Scripting in Comment Genius Plugin for WordPress

CVE-2026-1647

What is CVE-2026-1647?

The Comment Genius plugin for WordPress has a vulnerability that enables attackers to exploit insufficient input sanitization and output escaping through reflected cross-site scripting. By manipulating the $_SERVER['PHP_SELF'] parameter, unauthenticated users can inject arbitrary scripts into web pages. This occurs when a user is deceived into clicking a compromised link, leading to the execution of malicious scripts in their browser context. Website administrators should ensure their installations of the Comment Genius plugin are promptly updated to prevent potential exploitation.

References