CVE-2026-1191

The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and including, 1.2.8. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the `wp_footer` action. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/javascript-notifier/tags/1.2.8/javascript-notifier.php#L75
• https://plugins.trac.wordpress.org/browser/javascript-notifier/trunk/javascript-notifier.php#L75
• https://plugins.trac.wordpress.org/changeset/3449861/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/97696702-4d40-41dd-a25f-f2ee7681a2c9?source=cve

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11903Improper neutralization of input during web page generation …5.4
• CVE-2026-11904IBM Verify Identity Access 11.0 through 11.0.2 and IBM Secur…5.3
• CVE-2026-11906IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for…6.5
• CVE-2026-11907The Stream plugin for WordPress is vulnerable to authorizati…6.5
• CVE-2026-11908Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-11909Missing Authorization vulnerability in Drupal Examples for D…3.3
• CVE-2026-11911The Simple File List plugin for WordPress is vulnerable to a…7.5
• CVE-2026-11912The Simple File List plugin for WordPress is vulnerable to a…7.5
• CVE-2026-11913vulnerability in Drupal Mother May I allows . This issue aff…9.8
• CVE-2026-11914vulnerability in Drupal Composer allows . This issue affects…5.9
• CVE-2026-11915vulnerability in Drupal Brute force attack protection allows…5.9
• CVE-2026-11917A path traversal security issue exists within Rockwell Autom…7.2