CVE-2026-92712
MediumCVSS 6.4Summary
The ReactPress – Create React App for WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to and including 3.4.0 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body is written verbatim to disk via file_put_contents().
Risk Assessment
An attacker can inject malicious scripts that execute in other users' browsers, potentially leading to session theft, account takeover, or malware propagation.
Recommendation
Update the ReactPress plugin to the latest version that includes a fix. Additionally, restrict user permissions and regularly audit content for malicious scripts.
Other vulnerabilities in ReactPress
See all- CVE-2026-61685High
ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.
- CVE-2026-66455Medium
Broken Access Control vulnerability in ReactPress versions up to 3.4.0, exploitable by a user with Subscriber role.
Original NVD description (English source)
The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the permalink parameter is only passed through sanitize_url(), which does not prevent fetching attacker-controlled remote URLs whose response body — including script tags and event-handler attributes — is written verbatim to disk via file_put_contents().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS