CVE-2026-97020

MediumCVSS 6.4/10Last modified Oct 15, 2026

Description

The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is loaded as a replacement .po/.mo translation file via the plugin's own load_textdomain_mofile filter, causing WordPress to serve the attacker-written translation in place of the original core strings.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-970237.1A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cau CVE-2026-970247.1A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to caus CVE-2026-970253.2Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowi CVE-2026-970263.9Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777). On multi-user systems wi CVE-2026-970273.6Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service CVE-2026-970295.7Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls from reaching proces CVE-2026-97037.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only th CVE-2026-970306.1A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped CVE-2026-970317.5Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could t CVE-2026-970327.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies CVE-2026-97048.8A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token CVE-2026-97056.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT