CVE-2026-7543
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to and including 2.7.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker can inject malicious JavaScript, leading to session theft, phishing redirects, or website defacement without requiring any WordPress account.
Recommendation
Immediately update the Breakdance plugin to version 2.7.2 or later, which includes a fix for the XSS vulnerability.
Other vulnerabilities in Breakdance
See all- CVE-2026-57735High
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
- CVE-2026-65551High
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.
Original NVD description (English source)
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.