HUMMINGBIRD-PERFORMANCE · CVE-2026-121763 · Package
NO FIX YET · SEE WHAT TO DO
The Hummingbird performance plugin for WordPress, made by WPMU DEV, does not properly sanitize some input before rendering it in a page. An attacker who can store content in the site can run scripts in other users' browsers.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Hummingbird performance plugin at version 3.21.2 or older are exposed. The sources do not state which roles can store the malicious input, so assume any site with user-submitted content or multiple editors could be affected.
Not affected if plugin-not-installed
Who cares hummingbird, self-hosted, wordpress
wp plugin get hummingbird-performance --field=version3.21.2 or older3.21.2 (the sources do not name the exact fixed release)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.