CVE-2026-57391
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Loops & Logic WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. All versions up to and including 4.2.3 are affected.
Risk Assessment
An attacker can inject a malicious script that executes in the browsers of administrators and users, potentially leading to session theft, account takeover, or content modification.
Recommendation
Immediately update the Loops & Logic plugin to a version newer than 4.2.3 if available, or apply temporary mitigations (e.g., WAF rules) until a patch is released.
Other vulnerabilities in Loops & Logic
See all- CVE-2026-95604High
Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.
- CVE-2026-16960High
The Loops & Logic WordPress plugin before version 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see. This allows unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tangible Loops & Logic tangible-loops-and-logic allows Stored XSS.This issue affects Loops & Logic: from n/a through <= 4.2.3.