Stored Cross-Site Scripting in WP Latest Posts Plugin by WordPress

CVE-2026-9620

What is CVE-2026-9620?

The WP Latest Posts plugin for WordPress allows for a Stored Cross-Site Scripting vulnerability due to inadequate output escaping. Authenticated attackers with author-level access can exploit this flaw by injecting malicious web scripts through manipulated image src attributes in post content. The vulnerability lies in the improper handling of the src attribute during the reconstruction of elements and CSS background-image declarations, which occurs without sufficient filtering. As a result, any user accessing a page with the injected script could unknowingly execute it, raising significant security risks.

References