CVE-2026-2602 in Twentig Supercharged Block Editor Plugin
要約 (英語)
The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
責任者
Wordfence
予約する
2026年02月16日
公開
2026年03月29日
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 354104 | Twentig Supercharged Block Editor Plugin Parameter クロスサイトスクリプティング | 79 | 未定義 | 未定義 | CVE-2026-2602 |