CVE-2026-57735
HighCVSS 7.1Summary
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
Risk Assessment
The organization is at risk of user session theft, redirects to malicious sites, and theft of data entered by visitors.
Recommendation
Update the Breakdance plugin to a version above 2.7.1 that fixes the XSS vulnerability.
Other vulnerabilities in Breakdance
See all- CVE-2026-65551High
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.
- CVE-2026-7543High
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to and including 2.7.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.