CVE-2026-81775

HighCVSS 7.1

Published: 02/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Unauthenticated XSS vulnerability in Estatik versions up to 4.3.4. An attacker can inject a malicious script that executes in the victim's browser.

Risk of data theft, session hijacking, or malware distribution.

Update the plugin to the latest version with the fix.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS