CVE-2026-4322

MediumCVSS 6.1

Published: 03/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Destekz plugin from Raera - Ankara Web Design and Digital Advertising Agency contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to 02062026, and the product is no longer supported by the vendor.

Risk Assessment

An attacker can inject a malicious script into the page, which executes in the victim's browser, leading to session theft, redirects, or data theft. Lack of vendor support means the vulnerability will not be patched.

Recommendation

Immediately disable or remove the Destekz plugin from the system, as it is no longer supported and will not receive security fixes. Consider replacing it with an alternative, actively maintained solution.

Other vulnerabilities in Destekz

CVE-2026-4321Critical
A SQL injection vulnerability has been discovered in Destekz by Raera - Ankara Web Design and Digital Advertising Agency, due to improper neutralization of special elements in SQL commands. This flaw allows an attacker to execute arbitrary SQL queries on the database.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital Advertising Agency Destekz allows Reflected XSS. This issue affects Destekz: through 02062026. NOTE: The vendor was contacted and it was learned that the product is not supported.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS