CVE-2026-1451
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The rognone plugin for WordPress up to version 0.6.2 is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'a' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts that execute when a user clicks a link.
Risk Assessment
An attacker could steal user data, hijack sessions, or perform other malicious actions in the victim's browser context.
Recommendation
Update the rognone plugin to the latest version (above 0.6.2) or apply temporary mitigations such as filtering the 'a' parameter.
Other vulnerabilities in rognone
Original NVD description (English source)
The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS