CVE-2026-2432

The CM Custom Reports – Flexible reporting to track what matters most plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/cm-custom-reports/tags/1.2.7/backend/classes/modules/GraphModule.php#L151
• https://plugins.trac.wordpress.org/browser/cm-custom-reports/trunk/backend/classes/modules/GraphModule.php#L151
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3464005%40cm-custom-reports&new=3464005%40cm-custom-reports&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e642b5e1-62c1-4aa9-b579-6b2338227dd5?source=cve

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24314Under certain conditions SAP S/4HANA (Manage Payment Media) …4.3
• CVE-2026-24315SAP Fiori Launchpad allows attackers to craft malicious URLs…4.2
• CVE-2026-24316SAP NetWeaver Application Server for ABAP provides an ABAP R…6.4
• CVE-2026-24317SAP GUI for Windows allows DLL files to be loaded from arbit…5
• CVE-2026-24318Due to an Insecure session management vulnerability in SAP B…4.2
• CVE-2026-24319In SAP Business One, sensitive information is written to the…5.8
• CVE-2026-24320Due to improper memory management in SAP NetWeaver and ABAP …3.1
• CVE-2026-24321SAP Commerce Cloud exposes multiple API endpoints to unauthe…5.3
• CVE-2026-24322SAP Solution Tools Plug-In (ST-PI) contains a function modul…7.7
• CVE-2026-24323The BSP applications allow an unauthenticated user to inject…6.1
• CVE-2026-24324SAP BusinessObjects Business Intelligence Platform (AdminToo…6.5
• CVE-2026-24325SAP BusinessObjects Enterprise does not sufficiently encode …4.8