CVE-2026-42733

High

Published: 27/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

CVE-2026-42733 describes an improper neutralization of input during web page generation in the WPCS currency-switcher plugin, leading to DOM-Based XSS attacks. This issue affects WPCS from n/a through version 1.3.1.

Risk Assessment

An attacker could exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking. Organizations using this plugin are at significant security risk.

Recommendation

It is recommended to update the WPCS plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the web application is advisable.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 WPCS currency-switcher allows DOM-Based XSS.This issue affects WPCS: from n/a through <= 1.3.1.