CVE-2026-12402

MediumCVSS 4.4

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The OTP Login & Register Woocommerce plugin for WordPress in all versions up to and including 2.7.3 is vulnerable to Stored Cross-Site Scripting via the 'fb-config' setting due to insufficient input sanitization and output escaping. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

Risk Assessment

An authenticated attacker with administrator-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page, potentially leading to super administrator account takeover on multisite.

Recommendation

Update the OTP Login & Register Woocommerce plugin to a version newer than 2.7.3 once available, and consider limiting the number of administrators on the multisite installation.

Other vulnerabilities in OTP Login & Register Woocommerce WordPress plugin

CVE-2026-110135High
The OTP Login & Register Woocommerce WordPress plugin before 2.7.3 does not adequately limit one-time-password verification attempts, because the attempt limit is tracked against a value the client itself supplies and can change freely, allowing an unauthenticated attacker to bypass the limit and brute-force the short numeric login code to take over an account without its password.

Original NVD description (English source)

The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fb-config' Setting in all versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. On multisite installations where administrators do not hold the unfiltered_html capability, this vulnerability can be leveraged to target the network super administrator.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS