Stored Cross-Site Scripting in ReactPress Plugin for WordPress

CVE-2026-92712

What is CVE-2026-92712?

The ReactPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through the 'permalink' parameter in all versions up to and including 3.4.0. This vulnerability arises from inadequate input sanitization and output escaping, enabling authenticated attackers with subscriber-level access or higher to insert arbitrary web scripts into pages. When a user accesses an affected page, those scripts are executed, potentially compromising sensitive data or user sessions. The vulnerability stems from the fact that the permalink parameter only undergoes sanitize_url(), which fails to block requests to remote URLs that can contain malicious content, allowing attackers to write script tags and event-handler attributes directly to disk.

References