CVE-2026-1450

MediumCVSS 6.1

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

11th percentile - higher than 11% of all known CVEs

Summary

The rognone plugin for WordPress up to version 0.6.2 is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a victim clicks a link.

Risk Assessment

An attacker can steal session cookies, redirect the user to a malicious site, or perform other actions in the context of the victim's session.

Recommendation

Update the rognone plugin to the latest version. In the meantime, avoid clicking suspicious links and use a Web Application Firewall.

Other vulnerabilities in rognone

CVE-2026-1451Medium
The rognone plugin for WordPress up to version 0.6.2 is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'a' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute when a user clicks a link.

Original NVD description (English source)

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS