CVE-2026-94166

HighCVSS 7.1

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

6th percentile - higher than 6% of all known CVEs

Summary

The UpSolution Core plugin for WordPress (up to version 8.44) contains a Reflected XSS vulnerability due to improper input neutralization. An attacker can inject malicious JavaScript that executes in the victim's browser.

Risk Assessment

An attacker can steal session cookies, hijack user accounts, or perform actions on their behalf. For privileged accounts, this may lead to site takeover.

Recommendation

Update the UpSolution Core plugin to the latest version (above 8.44). If not possible, disable the plugin until a patch is released.

Other vulnerabilities in UpSolution Core

CVE-2026-95610High
Blind SQL Injection vulnerability in the UpSolution Core. Affects versions from n/a through 9.3.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS