CVE-2026-62034

HighCVSS 7.1

Published: 10/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Unauthenticated Cross Site Scripting (XSS) in the Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21. An attacker can inject malicious script into the page.

Risk Assessment

Potential for executing scripts in the user's browser, leading to data theft or session hijacking.

Recommendation

Update the Before After Image Comparison – Image comparison for WP plugin to the latest version with the security fix.

Other vulnerabilities in Before After Image Comparison – Image comparison for WP

CVE-2026-62028Medium
The Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS