CVE-2026-104395
HighCVSS 7.1Summary
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Risk Assessment
An unauthenticated attacker can inject malicious script that executes in a victim's browser, potentially leading to session or data theft.
Recommendation
Update the picu plugin to a version newer than 3.10.1 that contains the fix for this vulnerability.
Other vulnerabilities in picu
See all- CVE-2026-104406High
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-57387High
The picu WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.5.1.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS