CVE-2026-2602 in Twentig Supercharged Block Editor Plugin
Sumário (Inglês)
The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Responsável
Wordfence
Reservar
16/02/2026
Divulgação
29/03/2026
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354104 | Twentig Supercharged Block Editor Plugin Parameter Script de Site Cruzado | 79 | Não definido | Não definido | CVE-2026-2602 |