{"id":"CVE-2026-115966","kind":"vulnerability","aliases":["CVE-2026-115966"],"related":[],"title":"Typing Text WordPress plugin: stored XSS through versions 2.2.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Text – Give your texts many typing effects text-typing allows Stored XSS.This issue affects Typing Text – Give your texts many typing effects: from n/a through 2.2.0.","summary":"The Typing Text WordPress plugin by bPlugins does not neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can store content in the plugin can run scripts in the browser of visitors or administrators who view that content.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WordPress site has the plugin 'Typing Text – Give your texts many typing effects' installed and its version (WordPress admin > Plugins).\n- Look for the plugin's version in `wp-content/plugins/` (the plugin readme or main file header).","fix":"- Update the 'Typing Text' plugin to a version newer than `2.2.0`, if a fixed release is published; the sources do not name the fixed version.\n- Until a fix is installed, deactivate the plugin if it is not essential.","status":"open","published_at":"2026-10-26T18:17:40+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","triaged_at":"2026-10-26T18:33:59+00:00","updated_at":"2026-10-26T18:33:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T18:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the 'Typing Text' plugin to a version newer than `2.2.0`, if a fixed release is published; the sources do not name the fixed version.\n- Until a fix is installed, deactivate the plugin if it is not essential.","reach":"internet","title":"Typing Text WordPress plugin: stored XSS through versions 2.2.0","impact":"medium","summary":"The Typing Text WordPress plugin by bPlugins does not neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can store content in the plugin can run scripts in the browser of visitors or administrators who view that content.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker script runs in visitors' or admins' browsers on the site.","analyst_note":"Confirm the fixed version and which privilege level is needed to store the payload, from the NVD entry or the plugin's changelog.","how_to_check":"- Check whether the WordPress site has the plugin 'Typing Text – Give your texts many typing effects' installed and its version (WordPress admin > Plugins).\n- Look for the plugin's version in `wp-content/plugins/` (the plugin readme or main file header).","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Typing Text plugin at version 2.2.0 or earlier, where the plugin renders stored text on pages. Sites without this plugin installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3328,"output_tokens":578,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115966':12A,15A '-2026':11A,14A '2.2.0':9A,108C 'administr':61B 'affect':96C 'allow':37B,92C 'attack':44B 'bplugin':27B,80C 'browser':57B 'content':48B,65B 'cross':40B,75C 'cross-sit':39B,74C 'cve':10A,13A 'effect':88C,104C 'generat':33B,73C 'give':83C,99C 'improp':66C 'input':31B,69C 'issu':95C 'mani':86C,102C 'n/a':106C 'neutral':30B,67C 'packag':16B 'page':35B,72C 'plugin':4A,20B,25B,51B 'run':53B 'script':42B,54B,77C 'site':41B,76C 'store':5A,38B,47B,93C 'text':2A,23B,82C,85C,90C,98C,101C 'text-typ':89C 'type':1A,22B,81C,87C,91C,97C,103C 'version':8A 'view':63B 'visitor':59B 'vulner':78C 'web':34B,71C 'wordpress':3A,17B,19B,24B 'wordpress-plugin':18B 'xss':6A 'xss.this':94C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Typing Text plugin at version 2.2.0 or earlier, where the plugin renders stored text on pages. Sites without this plugin installed are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115966","severity":null,"published_at":"2026-10-26T18:17:40+00:00","modified_at":"2026-10-26T18:17:40+00:00","first_seen_at":"2026-10-26T18:31:43+00:00","fetched_at":"2026-10-26T18:31:43+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}