CVE-2026-9620

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0.11. This is due to insufficient output escaping in the field() and loop() functions, which extract the raw src attribute value from <img> tags within post_content using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating the unescaped value — bypassing WordPress's kses filtering entirely. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2284
• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2326
• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2738
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e00f69d6-df33-4179-843b-98f8ed034e4a?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9612The WhatsOrder – Instant Checkout for WooCommerce plugin for…5.3
• CVE-2026-9614An Improper Access Control vulnerability in Ivanti Neurons f…8.8
• CVE-2026-9616The Generate Security.txt plugin for WordPress is vulnerable…4.3
• CVE-2026-9617PostgreSQL Anonymizer contains a vulnerability that allows a…8.8
• CVE-2026-9618The PeachPay — Payments & Express Checkout for WooCommerce (…4.3
• CVE-2026-9619The Reviews and Rating – Docplanner plugin for WordPress is …4.3
• CVE-2026-9626The JSON API User plugin for WordPress is vulnerable to Stor…6.4
• CVE-2026-9627A security flaw has been discovered in UTT HiPER 1200GW up t…8.8
• CVE-2026-9628A weakness has been identified in UTT HiPER 1200GW up to 2.5…8.8
• CVE-2026-9629The Canvas plugin for WordPress is vulnerable to Stored Cros…6.4
• CVE-2026-9631A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-9632A flaw has been found in UTT HiPER 1250GW up to 3.2.7-210907…8.8