CVE-2026-57387
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The picu WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to improper input neutralization during page generation. This affects all versions up to and including 3.5.1.
Risk Assessment
An attacker can inject a malicious script that executes in the browsers of administrators and users, potentially leading to session hijacking, account takeover, or website defacement.
Recommendation
Immediately update the picu plugin to version 3.5.2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in picu
See all- CVE-2026-104406High
picu plugin in versions up to and including 3.10.1 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-104395High
picu plugin in versions up to and including 3.10.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through <= 3.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS