CVE-2026-2719

The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/private-wp-suite/tags/0.4.1/private-wp-suite.php#L153
• https://plugins.trac.wordpress.org/browser/private-wp-suite/trunk/private-wp-suite.php#L153
• https://www.wordfence.com/threat-intel/vulnerabilities/id/af88a631-c4ec-47ec-ad9b-1ef38ea1be09?source=cve

Published

Apr 22, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2718The Dealia – Request a Quote plugin for WordPress is vulnera…6.4
• CVE-2026-27180MajorDoMo (aka Major Domestic Module) is vulnerable to unaut…9.8
• CVE-2026-27181MajorDoMo (aka Major Domestic Module) allows unauthenticated…8.7
• CVE-2026-27182Saturn Remote Mouse Server contains a command injection vuln…8.6
• CVE-2026-27183OpenClaw versions prior to 2026.3.7 contain a shell approval…5.3
• CVE-2026-27189OpenSift is an AI study tool that sifts through large datase…5.8
• CVE-2026-27190Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…9.8
• CVE-2026-27191Feathersjs is a framework for creating web APIs and real-tim…6.1
• CVE-2026-27192Feathersjs is a framework for creating web APIs and real-tim…8.1
• CVE-2026-27193Feathersjs is a framework for creating web APIs and real-tim…5.3
• CVE-2026-27194D-Tale is a visualizer for pandas data structures. Versions …9.8
• CVE-2026-27195Wasmtime is a runtime for WebAssembly. Starting with Wasmtim…7.5