{"id":"CVE-2026-121763","kind":"vulnerability","aliases":["CVE-2026-121763"],"related":[],"title":"WordPress Hummingbird plugin: stored XSS through 3.21.2","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.","summary":"The Hummingbird performance plugin for WordPress, made by WPMU DEV, does not properly sanitize some input before rendering it in a page. An attacker who can store content in the site can run scripts in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hummingbird-performance","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["hummingbird","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Hummingbird version in the WordPress admin plugin list or with `wp plugin get hummingbird-performance --field=version`\n- Confirm whether the installed version is `3.21.2` or older","fix":"- Hummingbird: move to a version later than `3.21.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:23+00:00","updated_at":"2026-11-09T10:26:23+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T10:26:23Z","model":"claude-haiku-5-5","output":{"fix":"- Hummingbird: move to a version later than `3.21.2` (the sources do not name the exact fixed release)","reach":"internet","title":"WordPress Hummingbird plugin: stored XSS through 3.21.2","impact":"medium","summary":"The Hummingbird performance plugin for WordPress, made by WPMU DEV, does not properly sanitize some input before rendering it in a page. An attacker who can store content in the site can run scripts in other users' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","hummingbird","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in victims' browsers on the site","analyst_note":"Confirm the first fixed Hummingbird version and the required privilege level from the NVD entry or WPMU DEV changelog.","how_to_check":"- Check the installed Hummingbird version in the WordPress admin plugin list or with `wp plugin get hummingbird-performance --field=version`\n- Confirm whether the installed version is `3.21.2` or older","plain_action":"","product_name":"hummingbird-performance","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Hummingbird performance plugin at version 3.21.2 or older are exposed. The sources do not state which roles can store the malicious input, so assume any site with user-submitted content or multiple editors could be affected.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4552,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121763':10A,13A '-2026':9A,12A '3.21.2':7A,90C 'affect':85C 'allow':81C 'attack':46B 'browser':60B 'content':50B 'cross':70C 'cross-sit':69C 'cve':8A,11A 'dev':32B,76C 'generat':68C 'host':21B 'hummingbird':2A,15A,17B,24B,77C,79C,86C 'hummingbird-perform':78C 'hummingbird-performance':14A 'improp':61C 'input':38B,64C 'issu':84C 'made':29B 'n/a':88C 'neutral':62C 'packag':18B 'page':44B,67C 'perform':25B,80C 'performance':16A 'plugin':3A,26B 'proper':35B 'render':40B 'run':55B 'sanit':36B 'script':56B,72C 'self':20B 'self-host':19B 'site':53B,71C 'store':4A,49B,82C 'user':59B 'vulner':73C 'web':66C 'wordpress':1A,22B,28B 'wpmu':31B,75C 'xss':5A 'xss.this':83C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Hummingbird performance plugin at version 3.21.2 or older are exposed. The sources do not state which roles can store the malicious input, so assume any site with user-submitted content or multiple editors could be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["hummingbirdperformance"],"ptokens":["hummingbird","performance"],"labels":["hummingbird","medium","package","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-121763':10A,13A '-2026':9A,12A '3.21.2':7A 'cve':8A,11A 'hummingbird':2A,15A 'hummingbird-performance':14A 'performance':16A 'plugin':3A 'store':4A 'wordpress':1A 'xss':5A","search_b":"'attack':46B 'browser':60B 'content':50B 'dev':32B 'host':21B 'hummingbird':17B,24B 'input':38B 'made':29B 'packag':18B 'page':44B 'perform':25B 'plugin':26B 'proper':35B 'render':40B 'run':55B 'sanit':36B 'script':56B 'self':20B 'self-host':19B 'site':53B 'store':49B 'user':59B 'wordpress':22B,28B 'wpmu':31B","search_c":"'3.21.2':90C 'affect':85C 'allow':81C 'cross':70C 'cross-sit':69C 'dev':76C 'generat':68C 'hummingbird':77C,79C,86C 'hummingbird-perform':78C 'improp':61C 'input':64C 'issu':84C 'n/a':88C 'neutral':62C 'page':67C 'perform':80C 'script':72C 'site':71C 'store':82C 'vulner':73C 'web':66C 'wpmu':75C 'xss.this':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121763","severity":null,"published_at":"2026-11-09T10:17:07+00:00","modified_at":"2026-11-09T10:17:07+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}