{"id":"CVE-2026-116849","kind":"vulnerability","aliases":["CVE-2026-116849"],"related":[],"title":"StreamCast WordPress plugin: stored XSS through version 2.4.6","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.","summary":"The bPlugins StreamCast plugin does not sanitize some input before rendering it on a page, which allows stored cross-site scripting. An attacker with the ability to store content can run scripts in the browser of anyone who views that page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bplugins","package","streamcast","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the StreamCast plugin is installed and at which version, in the WordPress plugins list or the `streamcast` plugin folder.","fix":"- StreamCast: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-10-29T15:17:20+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:39+00:00","updated_at":"2026-10-29T15:26:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T15:26:39Z","model":"claude-haiku-5-5","output":{"fix":"- StreamCast: unknown (sources do not name a fixed version)","reach":"internet","title":"StreamCast WordPress plugin: stored XSS through version 2.4.6","impact":"medium","summary":"The bPlugins StreamCast plugin does not sanitize some input before rendering it on a page, which allows stored cross-site scripting. An attacker with the ability to store content can run scripts in the browser of anyone who views that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["streamcast","wordpress","bplugins"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in other visitors' browsers on the affected site.","analyst_note":"Confirm the fixed StreamCast version and the required privilege level from the vendor or WPScan advisory page.","how_to_check":"- Check whether the StreamCast plugin is installed and at which version, in the WordPress plugins list or the `streamcast` plugin folder.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the StreamCast plugin by bPlugins at version 2.4.6 or earlier are in scope. The sources describe stored XSS, so the attacker must be able to save input that is later rendered to other visitors; the sources do not say which role or input is needed. Sites without StreamCast can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":4114,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116849':11A,14A '-2026':10A,13A '2.4.6':8A,87C 'abil':45B 'affect':82C 'allow':35B,78C 'anyon':56B 'attack':42B 'bplugin':15B,20B,75C 'browser':54B 'content':48B 'cross':38B,70C 'cross-sit':37B,69C 'cve':9A,12A 'generat':68C 'improp':61C 'input':27B,64C 'issu':81C 'n/a':85C 'neutral':62C 'packag':16B 'page':33B,60B,67C 'plugin':3A,22B 'render':29B 'run':50B 'sanit':25B 'script':40B,51B,72C 'site':39B,71C 'store':4A,36B,47B,79C 'streamcast':1A,17B,21B,76C,77C,83C 'version':7A 'view':58B 'vulner':73C 'web':66C 'wordpress':2A,18B 'xss':5A 'xss.this':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the StreamCast plugin by bPlugins at version 2.4.6 or earlier are in scope. The sources describe stored XSS, so the attacker must be able to save input that is later rendered to other visitors; the sources do not say which role or input is needed. Sites without StreamCast can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116849","severity":null,"published_at":"2026-10-29T15:17:20+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}