CVE-2026-77820

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wpcomplete/tags/2.9.5.7/includes/class-wpcomplete.php#L305
• https://plugins.trac.wordpress.org/browser/wpcomplete/tags/2.9.5.7/public/class-wpcomplete-public.php#L1692
• https://plugins.trac.wordpress.org/browser/wpcomplete/tags/2.9.5.7/public/class-wpcomplete-public.php#L1802
• https://plugins.trac.wordpress.org/browser/wpcomplete/tags/2.9.5.7/public/class-wpcomplete-public.php#L1859
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5b91bb81-b5e4-4a50-833b-e2e98ccc09ff?source=cve

Published

Sep 19, 2026

Last Modified

Sep 19, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77811Improper input validation in the dashboards-observability pl…8.7
• CVE-2026-77812DJI drones transmit DUML (DJI Universal Markup Language) pro…9.4
• CVE-2026-77814is_path_trusted in scripts/iib/api.py compares the requested…7.5
• CVE-2026-77815to_abs_path in scripts/iib/tool.py normalised the requested …7.5
• CVE-2026-77818Improper neutralization of input during web page generation …6.1
• CVE-2026-7782A vulnerability was detected in CodeCanyon Perfex CRM up to …6.3
• CVE-2026-77822IBM ContextForge MCP Gateway could allow a remote authentica…9.6
• CVE-2026-77823The LearnPress plugin for WordPress is vulnerable to SQL Inj…4.9
• CVE-2026-77824The Media Sweep – WordPress Media Cleaner plugin for WordPre…4.9
• CVE-2026-77826The RegistrationMagic WordPress plugin before 6.0.9.9 does …8.8
• CVE-2026-77827Maono Link 3.8.13 MaonoAiServices Windows service allows loc…7.1
• CVE-2026-7783A flaw has been found in CodeCanyon Perfex CRM up to 3.4.1. …6.3