Stored Cross-Site Scripting Vulnerability in Private WP Suite Plugin for WordPress

CVE-2026-2719

What is CVE-2026-2719?

The Private WP Suite plugin for WordPress is susceptible to a stored cross-site scripting vulnerability that allows authenticated users with Administrator-level access to inject and execute arbitrary web scripts. This vulnerability arises from inadequate input sanitization and output escaping within the 'Exceptions' setting. The risk is particularly pronounced in multi-site installations and those where unfiltered_html functionality is disabled, resulting in potential exploitation whenever a user interacts with an affected page.

References