CVE-2026-87901

HighCVSS 8.3/10Last modified Oct 23, 2026

Description

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

Metrics

CVSS 3.0 8.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-879028.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the CVE-2026-879075.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking serCVE-2026-879087.5multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the paCVE-2026-879097.5The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. ThisCVE-2026-87916.4The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versiCVE-2026-879105.7When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, thCVE-2026-879119.6An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1CVE-2026-879125.9A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remoCVE-2026-879135.9A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain CVE-2026-879157.2The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to StoCVE-2026-879165.3The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, CVE-2026-879176.1The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in al
CVE-2026-87901: High severity, CVSS 8.3 | Vulnix