Cross-Site Request Forgery Vulnerability in Wp Js Detect Plugin for WordPress

CVE-2026-9731

What is CVE-2026-9731?

The Wp Js Detect plugin for WordPress contains a vulnerability that exposes it to Cross-Site Request Forgery attacks. This flaw arises from inadequate nonce validation in the plugin_settings function, allowing unauthenticated attackers to manipulate the plugin's notification text and CSS settings. If an attacker can deceive a site administrator into executing an action, such as clicking a crafted link, they can inject arbitrary content that is displayed unescaped on the front end of the site. This poses significant risks to site integrity as it enables attackers to alter the user experience and potentially compromise the security of the website.

References