CVE-2026-0690

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-06914.4The CM E-Mail Blacklist – Simple email filtering for safer registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-06927.5The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and includin CVE-2026-06934.4The Allow HTML in Category Descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via category descriptions in all v CVE-2026-06946.4The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and CVE-2026-06955.4In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output CVE-2026-06966.5In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this cou CVE-2026-06977.2A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /int CVE-2026-06987.2A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /inter CVE-2026-06997.2A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/adm CVE-2026-07009.8A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern CVE-2026-07017.2A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functi CVE-2026-07027.5The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'fields' parameter in