{"id":"CVE-2026-110384","kind":"vulnerability","aliases":["CVE-2026-110384"],"related":[],"title":"WordPress Fancy Comments plugin: reflected XSS through 1.2.21","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21.","summary":"The Heateor Support Fancy Comments WordPress plugin does not neutralize input when generating a page, so a crafted link can inject script into the page. An attacker can run JavaScript in a visitor's browser, such as stealing session cookies or acting as the logged-in user.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/fancy-facebook-comments/`\n- Run `wp plugin get fancy-facebook-comments --field=version` with WP-CLI","fix":"- Update the Fancy Comments plugin to a version later than `1.2.21`, as the sources do not name a fixed release\n- If no fixed version is available, deactivate or remove the plugin","status":"open","published_at":"2026-10-17T07:16:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:36:23+00:00","updated_at":"2026-10-25T03:36:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:23Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Fancy Comments plugin to a version later than `1.2.21`, as the sources do not name a fixed release\n- If no fixed version is available, deactivate or remove the plugin","reach":"internet","title":"WordPress Fancy Comments plugin: reflected XSS through 1.2.21","impact":"medium","summary":"The Heateor Support Fancy Comments WordPress plugin does not neutralize input when generating a page, so a crafted link can inject script into the page. An attacker can run JavaScript in a visitor's browser, such as stealing session cookies or acting as the logged-in user.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs script in visitors' browsers, stealing sessions","analyst_note":"Find the NVD entry or plugin changelog to confirm the fixed version and which parameter is reflected.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/fancy-facebook-comments/`\n- Run `wp plugin get fancy-facebook-comments --field=version` with WP-CLI","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Fancy Comments WordPress plugin at version 1.2.21 or earlier are exposed. The issue is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000624,"input_tokens":3324,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110384':11A,14A '-2026':10A,13A '1.2.21':8A,105C 'act':64B 'affect':98C 'allow':94C 'attack':49B 'browser':57B 'comment':3A,27B,88C,93C,100C 'cooki':62B 'craft':40B 'cross':80C 'cross-sit':79C 'cve':9A,12A 'facebook':92C 'fanci':2A,26B,87C,91C,99C 'fancy-facebook-com':90C 'generat':35B,78C 'heateor':24B,85C 'host':18B 'improp':71C 'inject':43B 'input':33B,74C 'issu':97C 'javascript':52B 'link':41B 'log':68B 'logged-in':67B 'n/a':103C 'neutral':32B,72C 'packag':15B 'page':37B,47B,77C 'plugin':4A,22B,29B 'reflect':5A,95C 'run':51B 'script':44B,82C 'self':17B 'self-host':16B 'session':61B 'site':81C 'steal':60B 'support':25B,86C 'user':70B 'visitor':55B 'vulner':83C 'web':76C 'wordpress':1A,19B,21B,28B,89C,101C 'wordpress-plugin':20B 'xss':6A 'xss.this':96C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Fancy Comments WordPress plugin at version 1.2.21 or earlier are exposed. The issue is reflected, so a visitor must open a crafted link; sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T07:16:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110384","severity":null,"published_at":"2026-10-17T07:16:50+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}