CVE-2026-77820
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The WPComplete plugin for WordPress (versions up to and including 2.9.9.0) is vulnerable to Stored Cross-Site Scripting via the 'empty' Shortcode Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This requires the premium version of the software. Please note this only affects the pro version.
Risk Assessment
An attacker with contributor privileges can inject persistent JavaScript that executes for visitors, potentially leading to session theft or content modification. This only affects the pro version of the plugin.
Recommendation
Update the WPComplete plugin (pro version) to a version newer than 2.9.9.0. Until then, consider restricting content publishing capabilities for contributors.
Other vulnerabilities in WPComplete
See all- CVE-2026-66599High
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
- CVE-2025-49906Medium
The WPComplete plugin has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions up to and including 2.9.5.3.
Original NVD description (English source)
The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS