CVE-2026-19056
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
Risk Assessment
An attacker can hijack an administrator session, potentially leading to full compromise of the WordPress site.
Recommendation
Update the ProSolution WP Client plugin to version 2.0.11 or later. Educate administrators about the risk of clicking suspicious links.
Other vulnerabilities in ProSolution WP Client WordPress plugin
Original NVD description (English source)
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS