CVE-2026-19055CWE-79cross-site-scripting

CVE-2026-19055

High · published August 19, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
15.6
In the wild
Unconfirmed
What it is

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-19T10:17Z
References (1)
https://wpscan.com/vulnerability/a1243ff3-3f0e-4068-a716-722e7cf4856b/ · [email protected]
EPSS history
Timeline
  • 19 AUG 06:00Z
    ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters
    cvelistv5