---
id: "CVE-2026-110525"
page: "https://infrastack.ai/live/CVE-2026-110525"
kind: "vulnerability"
aliases: ["CVE-2026-110525"]
title: "WordPress MCB plugin: request headers stored unescaped, run script in admin browsers"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mcb-plugin", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-06T06:16:39+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:42:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110525", "first_seen_at": "2026-11-06T06:40:11+00:00"}]
exploit_sources: []
---

# WordPress MCB plugin: request headers stored unescaped, run script in admin browsers

Link for people: https://infrastack.ai/live/CVE-2026-110525 (this .md is for agents)

The MCB WordPress plugin through 1.0.0 stores HTTP request header values without sanitising them and later shows them unescaped in the administrator statistics grid. An unauthenticated attacker can plant JavaScript that runs in an administrator's browser when the statistics page is opened.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the MCB plugin is installed and its version in the WordPress admin under Plugins, or with `wp plugin get <plugin-slug>`
- Confirm the installed version is `1.0.0` or earlier
- Look for the plugin's statistics page in the WordPress admin menu

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110525

## From the sources

The MCB  WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_