CVE-2026-94081

HighCVSS 7.1

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The WordPress Persistent Login plugin in versions <= 3.1.3 is vulnerable to unauthenticated Cross Site Scripting (XSS). An unauthenticated attacker can inject malicious script.

Risk Assessment

An unauthenticated attacker can execute malicious JavaScript in the victim's browser, potentially leading to session theft, redirects, or defacement.

Recommendation

Update the WordPress Persistent Login plugin to a version higher than 3.1.3. If needed, implement input filtering.

Other vulnerabilities in WordPress Persistent Login

CVE-2026-66594High
Subscriber SQL Injection in WordPress Persistent Login versions up to 3.1.0. A user with subscriber role can execute unauthorized database queries.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS