CVE-2026-9570

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-957015.1In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checkin CVE-2026-957028.5Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard cont CVE-2026-957035.1In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MI CVE-2026-957047.2A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to CVE-2026-957057.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957067.2Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to pe CVE-2026-957077.2A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve r CVE-2026-957087.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high priv CVE-2026-957097.2Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high priv CVE-2026-95716.5Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deacti CVE-2026-957107.1An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthentic CVE-2026-957117.1An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to c