CVE-2026-2502

The xmlrpc attacks blocker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0, via the 'X-Forwarded-For' HTTP header. This is due to the plugin trusting and logging attacker-controlled IP header data and rendering debug log entries without output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L186
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L269
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L312
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L341
• https://www.wordfence.com/threat-intel/vulnerabilities/id/059f0c64-efcc-4b79-81eb-b4ae9e3e2826?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25014Cross-Site Request Forgery (CSRF) vulnerability in themelook…4.3
• CVE-2026-25015Cross-Site Request Forgery (CSRF) vulnerability in Stiofan U…4.3
• CVE-2026-25016Missing Authorization vulnerability in Nelio Software Nelio …4.3
• CVE-2026-25017Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2026-25018Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-25019Missing Authorization vulnerability in Vito Peleg Atarim ata…5.3
• CVE-2026-25020Missing Authorization vulnerability in WP connect WP Sync fo…4.3
• CVE-2026-25021Missing Authorization vulnerability in Mizan Themes Mizan De…5.4
• CVE-2026-25022Improper Neutralization of Special Elements used in an SQL C…8.5
• CVE-2026-25023Exposure of Sensitive System Information to an Unauthorized …5.3
• CVE-2026-25024Cross-Site Request Forgery (CSRF) vulnerability in Blair Wil…5.4
• CVE-2026-25025Improper Neutralization of Input During Web Page Generation …7.1