CVE-2026-8626
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The SponsorMe plugin for WordPress up to version 0.5.2 is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a crafted link.
Risk Assessment
An attacker can hijack an administrator or user session, steal data, or perform other malicious actions in the victim's context.
Recommendation
Immediately update the SponsorMe plugin to the latest available version and follow general security practices such as avoiding clicking on suspicious links.
Original NVD description (English source)
The SponsorMe plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The PHP_SELF value is reflected in two separate locations within the vulnerable function — a form action attribute and an anchor href attribute — both of which can be exploited by appending a crafted payload to the wp-admin/admin.php URL path.