CVE-2026-5505

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The WP-Clippy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `clippy` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-550505.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.CVE-2026-550516.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.CVE-2026-550528.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-550537.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-550546.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-550557.8Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2026-550567.8Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-550575.5Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to disclose information locally.CVE-2026-550587.8Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-550596.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions priCVE-2026-55066.4The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wave` shortcode in all versions up to, and inclCVE-2026-550603.7GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended admin