CVE-2026-6858

Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS

High · published June 22, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00293 · 20.8th percentile
Published
2026-06-22T06:00Z
EPSS history
Timeline
  • 22 JUN 06:00Z
    Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS
    cvelistv5