CVE-2026-8624
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The LJ comments import: reloaded plugin for WordPress up to version 0.97.1 is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a crafted link.
Risk Assessment
An attacker can hijack an administrator or user session, steal data, or perform other malicious actions in the victim's context.
Recommendation
Immediately update the LJ comments import: reloaded plugin to the latest available version and follow general security practices such as avoiding clicking on suspicious links.
Original NVD description (English source)
The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function.