CVE-2026-95817

HighCVSS 7.2

Published: 02/10/2026(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to and including 3.6.0 due to insufficient input sanitization and output escaping. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute in the browser of users visiting affected pages, potentially leading to data theft or session hijacking.

Recommendation

Update the DoFollow Case by Case plugin to the latest patched version and consider tightening comment moderation policies.

Other vulnerabilities in DoFollow Case by Case

CVE-2025-62102Medium
The WordPress plugin DoFollow Case by Case in versions up to and including 3.5.1 is vulnerable to Cross-Site Request Forgery (CSRF). Missing proper request validation allows an attacker to trick an administrator into performing unauthorized actions on their behalf.

Original NVD description (English source)

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation delays but does not prevent exploitation — once an administrator approves the visually innocuous comment, the stored payload executes in the browser of every subsequent visitor to the affected post.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS