CVE-2026-81778
MediumCVSS 6.5Summary
Cross Site Scripting (XSS) vulnerability in Kalles Addons up to version 1.0.6. A subscriber-level attacker can inject malicious scripts.
Risk Assessment
Potential for script execution in victim's browser, leading to session theft, account takeover, or other attacks.
Recommendation
Update the Kalles Addons plugin to the latest patched version.
Other vulnerabilities in Kalles Addons
See all- CVE-2026-73389Critical
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
- CVE-2026-78572High
The Kalles Addons plugin for WordPress up to version 1.0.6 is vulnerable to PHP Object Injection via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP object. No known POP chain exists in the vulnerable software, so the vulnerability has no impact unless another plugin or theme with a POP chain is installed.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.