CVE-2026-110525 · Package
NO FIX YET
The MCB WordPress plugin through 1.0.0 stores HTTP request header values without sanitising them and later shows them unescaped in the administrator statistics grid. An unauthenticated attacker can plant JavaScript that runs in an administrator's browser when the statistics page is opened.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MCB WordPress plugin version 1.0.0 or earlier. The attacker only needs to send HTTP requests with crafted headers, and the script fires when an administrator views the plugin's statistics page. Sites that do not have the plugin installed are not affected.
Not affected if plugin-not-installed
Who cares mcb-plugin, wordpress
wp plugin get <plugin-slug>1.0.0 or earlierNo fix yet, per the sources.
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.