CVE-2026-119160

MediumCVSS 6.4

Published: 31/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Smart Post plugin for WordPress (versions up to and including 4.0.9) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown.

Risk Assessment

An attacker can execute arbitrary JavaScript in a user's browser, potentially hijacking sessions or stealing data. This requires user interaction with the injected UI element.

Recommendation

Update the Smart Post plugin to a version later than 4.0.9. Additionally, implement a Content Security Policy (CSP) and regularly review user-generated content.

Other vulnerabilities in Smart Post WordPress plugin

CVE-2026-78150Low
The Smart Post WordPress plugin before version 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and metadata.

Original NVD description (English source)

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown — a standard filter interaction requiring no elevated privileges from the victim.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS