{"id":"CVE-2026-125433","kind":"vulnerability","aliases":["CVE-2026-125433"],"related":[],"title":"Futurio Extra WordPress plugin: stored XSS through versions 2.0.25","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25.","summary":"Futurio Extra, a WordPress plugin by FuturioWP, has a stored cross-site scripting flaw in versions up to and including 2.0.25. An attacker who can store content on the site can run scripts in the browsers of visitors or administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"futurio-extra","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["futurio-extra","other","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Futurio Extra version in the WordPress plugins list or the `futurio-extra` plugin header.\n- Compare the installed version against `2.0.25`; anything at or below it is in the reported range.","fix":null,"status":"open","published_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","triaged_at":"2026-11-11T13:29:18+00:00","updated_at":"2026-11-11T13:29:18+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T13:29:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Futurio Extra WordPress plugin: stored XSS through versions 2.0.25","impact":"medium","summary":"Futurio Extra, a WordPress plugin by FuturioWP, has a stored cross-site scripting flaw in versions up to and including 2.0.25. An attacker who can store content on the site can run scripts in the browsers of visitors or administrators.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","futurio-extra","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitor or admin browsers on the site.","analyst_note":"Find the fixed version and the vulnerable input from the NVD entry or the plugin's changelog, since the sources only give the range through 2.0.25.","how_to_check":"- Check the installed Futurio Extra version in the WordPress plugins list or the `futurio-extra` plugin header.\n- Compare the installed version against `2.0.25`; anything at or below it is in the reported range.","plain_action":"","product_name":"futurio-extra","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Futurio Extra WordPress plugin at version 2.0.25 or earlier. The sources do not say which features or roles make it reachable, so the exposure is unknown beyond the stored-XSS description.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4550,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125433':12A,15A '-2026':11A,14A '2.0.25':9A,48B,98C 'administr':67B 'affect':92C 'allow':88C 'attack':50B 'browser':63B 'content':54B 'cross':38B,77C 'cross-sit':37B,76C 'cve':10A,13A 'extra':2A,18A,21B,28B,84C,87C,94C 'flaw':41B 'futurio':1A,17A,20B,27B,83C,86C,93C 'futurio-extra':16A,19B,85C 'futuriowp':33B,82C 'generat':75C 'host':25B 'improp':68C 'includ':47B 'input':71C 'issu':91C 'n/a':96C 'neutral':69C 'page':74C 'plugin':4A,31B 'run':59B 'script':40B,60B,79C 'self':24B 'self-host':23B 'site':39B,57B,78C 'store':5A,36B,53B,89C 'version':8A,43B 'visitor':65B 'vulner':80C 'web':73C 'wordpress':3A,26B,30B 'xss':6A 'xss.this':90C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Futurio Extra WordPress plugin at version 2.0.25 or earlier. The sources do not say which features or roles make it reachable, so the exposure is unknown beyond the stored-XSS description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["futurioextra"],"ptokens":["extra","futurio"],"labels":["futurioextra","medium","other","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125433':12A,15A '-2026':11A,14A '2.0.25':9A 'cve':10A,13A 'extra':2A,18A 'futurio':1A,17A 'futurio-extra':16A 'plugin':4A 'store':5A 'version':8A 'wordpress':3A 'xss':6A","search_b":"'2.0.25':48B 'administr':67B 'attack':50B 'browser':63B 'content':54B 'cross':38B 'cross-sit':37B 'extra':21B,28B 'flaw':41B 'futurio':20B,27B 'futurio-extra':19B 'futuriowp':33B 'host':25B 'includ':47B 'plugin':31B 'run':59B 'script':40B,60B 'self':24B 'self-host':23B 'site':39B,57B 'store':36B,53B 'version':43B 'visitor':65B 'wordpress':26B,30B","search_c":"'2.0.25':98C 'affect':92C 'allow':88C 'cross':77C 'cross-sit':76C 'extra':84C,87C,94C 'futurio':83C,86C,93C 'futurio-extra':85C 'futuriowp':82C 'generat':75C 'improp':68C 'input':71C 'issu':91C 'n/a':96C 'neutral':69C 'page':74C 'script':79C 'site':78C 'store':89C 'vulner':80C 'web':73C 'xss.this':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125433","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125433","severity":null,"published_at":"2026-11-11T13:17:20+00:00","modified_at":"2026-11-11T13:17:20+00:00","first_seen_at":"2026-11-11T13:27:13+00:00","fetched_at":"2026-11-11T13:27:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}