CVE-2026-17010CWE-79cross-site-scripting
CVE-2026-17010
Medium · published August 10, 2026
What it is
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
The record
Technical detail
- CVSS v3.1
- 5.4 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00226 · 12.6th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-08-10T11:16Z
References (1)
EPSS history
Timeline