Reflected Cross-Site Scripting Vulnerability in rexCrawler Plugin for WordPress

CVE-2026-2277

What is CVE-2026-2277?

The rexCrawler plugin for WordPress is susceptible to a reflected cross-site scripting vulnerability via the 'url' and 'regex' parameters in the search-pattern tester page, affecting all versions up to and including 1.0.15. This vulnerability arises due to inadequate input sanitization and failure to escape outputs, allowing unauthenticated attackers to inject arbitrary web scripts. A successful attack requires tricking an administrator into clicking a malicious link, which is particularly concerning for multi-site installations and those with unfiltered_html disabled.

References