Live › vulnerability › CVE-2026-116849
The bPlugins StreamCast plugin does not sanitize some input before rendering it on a page, which allows stored cross-site scripting. An attacker with the ability to store content can run scripts in the browser of anyone who views that page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the StreamCast plugin by bPlugins at version 2.4.6 or earlier are in scope. The sources describe stored XSS, so the attacker must be able to save input that is later rendered to other visitors; the sources do not say which role or input is needed. Sites without StreamCast can skip it.
No product ranges from the sources yet.
streamcast plugin folder.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-116849")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.