CVE-2026-1278

The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://downloads.wordpress.org/plugin/mandatory-fields.1.6.8.zip
• https://plugins.trac.wordpress.org/browser/mandatory-fields/tags/1.6.8/mandatory-plugin-option-page.php#L14
• https://plugins.trac.wordpress.org/browser/mandatory-fields/trunk/mandatory-plugin-option-page.php#L14
• https://wordpress.org/plugins/mandatory-fields/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e262ec15-420a-4f52-90e0-e4a2e28402a1?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12773A weakness has been identified in BerriAI litellm up to 1.59…9.8
• CVE-2026-12774A security vulnerability has been detected in BerriAI litell…6.3
• CVE-2026-12775A vulnerability was detected in Montodel House-Rental-Manage…7.3
• CVE-2026-12776A flaw has been found in Montodel House-Rental-Management up…6.3
• CVE-2026-12778A vulnerability has been found in AOMEI Partition Assistant …7.8
• CVE-2026-12779A vulnerability was found in AOMEI Dynamic Disk Manager up t…7.8
• CVE-2026-12780A vulnerability was determined in AOMEI Backupper up to 8.3.…7.8
• CVE-2026-12781A vulnerability was identified in EaseUS Partition Master up…7.8
• CVE-2026-12782A security flaw has been discovered in EaseUS Partition Mast…7.8
• CVE-2026-12784A weakness has been identified in IM-Magic Partition Resizer…7.8
• CVE-2026-12786A vulnerability has been found in Ezbsystems UltraISO Premiu…7.8
• CVE-2026-12787A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Appli…6.3