Stored Cross-Site Scripting Vulnerability in OMGF Plugin for WordPress

CVE-2026-89417

What is CVE-2026-89417?

The OMGF plugin for WordPress, designed to be GDPR/DSGVO compliant, contains a vulnerability that allows for Stored Cross-Site Scripting through the 's' search parameter in the comments-atom feed. This flaw arises from inadequate input sanitization and output escaping, permitting unauthenticated attackers to inject arbitrary web scripts into pages. When a user accesses a compromised page, the injected script executes, which can occur if the server unwittingly serves a retained .tmp file without proper Content-Type or X-Content-Type-Options headers. This issue is particularly concerning as it affects default configurations found in many web servers like Apache and nginx/php-fpm.

References