CVE-2026-9620

The WP Latest Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted image src attributes in post content in versions up to, and including, 5.0.11. This is due to insufficient output escaping in the field() and loop() functions, which extract the raw src attribute value from <img> tags within post_content using a regular expression and then reconstruct new <img> elements or CSS background-image declarations by directly concatenating the unescaped value — bypassing WordPress's kses filtering entirely. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2284
• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2326
• https://plugins.trac.wordpress.org/browser/wp-latest-posts/tags/5.0.11/inc/wplp-front.inc.php#L2738
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e00f69d6-df33-4179-843b-98f8ed034e4a?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96188External control of system or configuration setting in Micro…7.3
• CVE-2026-9619The Reviews and Rating – Docplanner plugin for WordPress is …4.3
• CVE-2026-96192Use after free in Microsoft Edge for iOS allows an unauthori…8.8
• CVE-2026-96196Incomplete list of disallowed inputs in Microsoft Edge (Chro…8.8
• CVE-2026-96198Heap-based buffer overflow in Microsoft Edge (Chromium-based…8.8
• CVE-2026-96199Heap-based buffer overflow in Microsoft Edge (Chromium-based…8.8
• CVE-2026-96200The Payments for Hubtel WordPress plugin before 1.0.2 does n…5.3
• CVE-2026-96202Heap-based buffer overflow in Windows Raw Image Extension al…8.8
• CVE-2026-96203Use after free in Microsoft Edge (Chromium-based) allows an …8.8
• CVE-2026-96204Server-side request forgery (ssrf) in Azure Arc allows an au…6.5
• CVE-2026-96206Use of uninitialized resource in Windows Subsystem for Linux…5.5
• CVE-2026-96207Improper certificate validation in Microsoft Partner Center …10