WPJAM-BASIC · CVE-2026-125443 · Package
FIX → 7.1.4
WPJAM Basic, a WordPress plugin by Denishua, fails to neutralize input when it builds web pages, enabling DOM-based cross-site scripting. An attacker who gets a visitor to load a crafted page can run scripts in that visitor's browser session on the site.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the WPJAM Basic plugin (wpjam-basic) up to and including 7.1.2. Sites without this plugin are not affected. The sources do not say which settings or pages are needed to trigger it.
Not affected if plugin-not-installed
Who cares wordpress, wpjam-basic, xss
Upgrade to 7.1.4
Update WPJAM Basic to 7.1.4 or later (per Patchstack; not confirmed on a vendor page).
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.