Stored Cross-Site Scripting Vulnerability in LifePress Plugin for WordPress

CVE-2026-6690

What is CVE-2026-6690?

The LifePress plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) attack via the 'n' parameter in the lp_update_mds AJAX action. This vulnerability arises from the absence of nonce verification and capability checks, paired with inadequate input sanitization and output escaping when displaying the series name on the admin settings page. Attackers can exploit this to inject malicious scripts, which would execute whenever a user visits an affected page, putting user data and site integrity at risk.

References