Cross-Site Scripting Vulnerability in Virtue/Ascend/Pinnacle Toolkit by WordPress
CVE-2026-97266

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Virtue/ascend/pinnacle Toolkit
Vendor
CVE Published:
30 September 2026

What is CVE-2026-97266?

A contributor-level Cross-Site Scripting (XSS) vulnerability exists in versions of the Virtue/Ascend/Pinnacle Toolkit equal to or less than 4.9.12.1. This vulnerability allows authenticated users to inject arbitrary JavaScript code into the application, potentially compromising user data and session integrity. Exploitation of this flaw could lead to unauthorized actions being performed on behalf of the affected users.

Affected Version(s)

Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1

References

https://patchstack.com/database/wordpress/plugin/virtue-t...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Intrudify | Patchstack Bug Bounty Program
.