Reflected Cross-Site Scripting in Personal Authors Category Plugin for WordPress

CVE-2026-1754

What is CVE-2026-1754?

The Personal Authors Category plugin for WordPress allows unauthenticated attackers to exploit a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping. This flaw affects all versions up to 0.3, enabling attackers to inject arbitrary web scripts through the URL path. If a victim clicks on a malicious link crafted by the attacker, the malicious script can be executed in the context of the user's browser, potentially leading to session hijacking or other malicious actions.

References