CVE-2026-27403

MediumCVSS 6.5

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

The Hubbub Lite plugin for WordPress (versions up to 1.36.3) contains a stored XSS vulnerability due to improper input neutralization during page generation. An attacker can inject malicious scripts that execute in other users' browsers.

Risk Assessment

An attacker can execute scripts in the context of other users' sessions, potentially leading to session hijacking, account takeover, or unauthorized actions.

Recommendation

Update the Hubbub Lite plugin to a version above 1.36.3.

Other vulnerabilities in Hubbub Lite

CVE-2025-12471Medium
The Hubbub Lite plugin for WordPress (versions up to and including 1.36.0) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'dpsp_list_attention_search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that execute if a user is tricked into clicking a link.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS