{"id":"CVE-2026-125045","kind":"vulnerability","aliases":["CVE-2026-125045"],"related":[],"title":"Mediavine Create WordPress plugin: stored XSS through 3.1.1","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1.","summary":"The Mediavine Create plugin for WordPress, by John-Michael L'Allier, has a stored cross-site scripting flaw in versions through 3.1.1. An attacker who can inject content can run scripts in the browsers of people who view the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mediavine-create","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Create plugin (mediavine-create) in the WordPress admin plugin list.\n- Confirm whether any version `3.1.1` or earlier is active on the site.","fix":null,"status":"open","published_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:20+00:00","updated_at":"2026-11-11T13:29:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T13:29:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Mediavine Create WordPress plugin: stored XSS through 3.1.1","impact":"medium","summary":"The Mediavine Create plugin for WordPress, by John-Michael L'Allier, has a stored cross-site scripting flaw in versions through 3.1.1. An attacker who can inject content can run scripts in the browsers of people who view the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","mediavine-create"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers and can steal sessions","analyst_note":"Find the fixed version and the required privilege from the NVD entry or the plugin's changelog; the sources give only the range through 3.1.1.","how_to_check":"- Check the installed version of the Create plugin (mediavine-create) in the WordPress admin plugin list.\n- Confirm whether any version `3.1.1` or earlier is active on the site.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Mediavine Create WordPress plugin at version 3.1.1 or earlier are in the stated range. The sources do not say which user roles can inject the stored content, so whether low-privilege accounts can exploit it is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4543,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125045':11A,14A '-2026':10A,13A '3.1.1':8A,43B,95C 'affect':61B,90C 'allier':31B,81C 'allow':86C 'attack':45B 'browser':55B 'content':49B 'creat':2A,17B,22B,82C,85C,91C 'cross':36B,72C 'cross-sit':35B,71C 'cve':9A,12A 'flaw':39B 'generat':70C 'improp':63C 'inject':48B 'input':66C 'issu':89C 'john':28B,78C 'john-michael':27B,77C 'l':30B,80C 'mediavin':1A,16B,21B,84C 'mediavine-cr':15B,83C 'michael':29B,79C 'n/a':93C 'neutral':64C 'packag':18B 'page':62B,69C 'peopl':57B 'plugin':4A,23B 'run':51B 'script':38B,52B,74C 'site':37B,73C 'store':5A,34B,87C 'version':41B 'view':59B 'vulner':75C 'web':68C 'wordpress':3A,19B,25B 'xss':6A 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mediavine Create WordPress plugin at version 3.1.1 or earlier are in the stated range. The sources do not say which user roles can inject the stored content, so whether low-privilege accounts can exploit it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["mediavinecreate","medium","package","wordpress"],"campaign_type":null,"search_a":"'-125045':11A,14A '-2026':10A,13A '3.1.1':8A 'creat':2A 'cve':9A,12A 'mediavin':1A 'plugin':4A 'store':5A 'wordpress':3A 'xss':6A","search_b":"'3.1.1':43B 'affect':61B 'allier':31B 'attack':45B 'browser':55B 'content':49B 'creat':17B,22B 'cross':36B 'cross-sit':35B 'flaw':39B 'inject':48B 'john':28B 'john-michael':27B 'l':30B 'mediavin':16B,21B 'mediavine-cr':15B 'michael':29B 'packag':18B 'page':62B 'peopl':57B 'plugin':23B 'run':51B 'script':38B,52B 'site':37B 'store':34B 'version':41B 'view':59B 'wordpress':19B,25B","search_c":"'3.1.1':95C 'affect':90C 'allier':81C 'allow':86C 'creat':82C,85C,91C 'cross':72C 'cross-sit':71C 'generat':70C 'improp':63C 'input':66C 'issu':89C 'john':78C 'john-michael':77C 'l':80C 'mediavin':84C 'mediavine-cr':83C 'michael':79C 'n/a':93C 'neutral':64C 'page':69C 'script':74C 'site':73C 'store':87C 'vulner':75C 'web':68C 'xss.this':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125045","severity":null,"published_at":"2026-11-11T13:17:20+00:00","modified_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}