{"id":"CVE-2026-110525","kind":"vulnerability","aliases":["CVE-2026-110525"],"related":[],"title":"WordPress MCB plugin: request headers stored unescaped, run script in admin browsers","description":"The MCB  WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.","summary":"The MCB WordPress plugin through 1.0.0 stores HTTP request header values without sanitising them and later shows them unescaped in the administrator statistics grid. An unauthenticated attacker can plant JavaScript that runs in an administrator's browser when the statistics page is opened.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mcb-plugin","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the MCB plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>`\n- Confirm the installed version is `1.0.0` or earlier\n- Look for the plugin's statistics page in the WordPress admin menu","fix":null,"status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:06+00:00","updated_at":"2026-11-06T06:42:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:42:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress MCB plugin: request headers stored unescaped, run script in admin browsers","impact":"medium","summary":"The MCB WordPress plugin through 1.0.0 stores HTTP request header values without sanitising them and later shows them unescaped in the administrator statistics grid. An unauthenticated attacker can plant JavaScript that runs in an administrator's browser when the statistics page is opened.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mcb-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Administrator session hijacked through injected script in admin statistics page","analyst_note":"Confirm the fixed version or vendor status for MCB plugin on WordPress; the NVD entry gives no fix data.","how_to_check":"- Check whether the MCB plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>`\n- Confirm the installed version is `1.0.0` or earlier\n- Look for the plugin's statistics page in the WordPress admin menu","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the MCB WordPress plugin version 1.0.0 or earlier. The attacker only needs to send HTTP requests with crafted headers, and the script fires when an administrator views the plugin's statistics page. Sites that do not have the plugin installed are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4215,"output_tokens":578,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110525':15A,18A '-2026':14A,17A '1.0.0':29B,72C 'admin':11A 'administr':45B,58B,90C,104C 'allow':93C 'attack':50B,95C 'browser':12A,60B,106C 'cve':13A,16A 'escap':77C 'execut':101C 'grid':47B,92C 'header':5A,33B,79C 'http':31B 'javascript':53B,99C 'later':39B,85C 'malici':98C 'mcb':2A,20B,25B,68C 'mcb-plugin':19B 'open':66B 'packag':22B 'page':64B,111C 'plant':52B 'plugin':3A,21B,27B,70C 'render':86C 'request':4A,32B,78C 'run':8A,55B 'sanitis':36B,75C 'script':9A 'session':107C 'show':40B 'statist':46B,63B,91C,110C 'store':6A,30B,82C,97C 'unauthent':49B,94C 'unescap':7A,42B 'valu':34B,80C 'view':113C 'without':35B 'wordpress':1A,23B,26B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MCB WordPress plugin version 1.0.0 or earlier. The attacker only needs to send HTTP requests with crafted headers, and the script fires when an administrator views the plugin's statistics page. Sites that do not have the plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mcbplugin","medium","package","wordpress"],"campaign_type":null,"search_a":"'-110525':15A,18A '-2026':14A,17A 'admin':11A 'browser':12A 'cve':13A,16A 'header':5A 'mcb':2A 'plugin':3A 'request':4A 'run':8A 'script':9A 'store':6A 'unescap':7A 'wordpress':1A","search_b":"'1.0.0':29B 'administr':45B,58B 'attack':50B 'browser':60B 'grid':47B 'header':33B 'http':31B 'javascript':53B 'later':39B 'mcb':20B,25B 'mcb-plugin':19B 'open':66B 'packag':22B 'page':64B 'plant':52B 'plugin':21B,27B 'request':32B 'run':55B 'sanitis':36B 'show':40B 'statist':46B,63B 'store':30B 'unauthent':49B 'unescap':42B 'valu':34B 'without':35B 'wordpress':23B,26B","search_c":"'1.0.0':72C 'administr':90C,104C 'allow':93C 'attack':95C 'browser':106C 'escap':77C 'execut':101C 'grid':92C 'header':79C 'javascript':99C 'later':85C 'malici':98C 'mcb':68C 'page':111C 'plugin':70C 'render':86C 'request':78C 'sanitis':75C 'session':107C 'statist':91C,110C 'store':82C,97C 'unauthent':94C 'valu':80C 'view':113C 'wordpress':69C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110525","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}