HIGHCVSS v3.1 8.8Vulnerability
CVE-2026-110525
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Epss score
- 0.00235
- Cvss severity
- HIGH
- Cvss score
- 8.8
- Retrieved at
- 2026-11-07T06:44:43+00:00
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Score
- 8.8
- Cve id
- CVE-2026-110525
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-11-06T10:16:10+00:00
- Name
- CVE-2026-110525
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Published at
- 2026-11-06T06:16:39.460
- Last modified
- 2026-11-06T20:09:13.780
- Epss percentile
- 0.14588
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph