{"id":"CVE-2026-125443","kind":"vulnerability","aliases":["CVE-2026-125443"],"related":[],"title":"WPJAM Basic WordPress plugin: DOM-based XSS through input handling","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows DOM-Based XSS.This issue affects WPJAM Basic: from n/a through 7.1.2.","summary":"WPJAM Basic, a WordPress plugin by Denishua, fails to neutralize input when it builds web pages, enabling DOM-based cross-site scripting. An attacker who gets a visitor to load a crafted page can run scripts in that visitor's browser session on the site.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wpjam-basic","fixed":["7.1.4"],"affected":"<= 7.1.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","wordpress","wpjam-basic","xss"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check whether WPJAM Basic (wpjam-basic) is installed and its version. Versions up to and including 7.1.2 are listed as vulnerable.\n- Or run: wp plugin get wpjam-basic --field=version","fix":"Update WPJAM Basic to 7.1.4 or later (per Patchstack; not confirmed on a vendor page).","status":"open","published_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:32+00:00","updated_at":"2026-11-15T14:39:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WPJAM Basic WordPress plugin: DOM-based XSS through input handling","impact":"medium","summary":"WPJAM Basic, a WordPress plugin by Denishua, fails to neutralize input when it builds web pages, enabling DOM-based cross-site scripting. An attacker who gets a visitor to load a crafted page can run scripts in that visitor's browser session on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpjam-basic"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers on the site","analyst_note":"Confirm the fixed version and the vulnerable code path from the NVD entry or the vendor's plugin page; the sources give only 'through 7.1.2'.","how_to_check":"- Check whether the `wpjam-basic` plugin is installed and active on the WordPress site.\n- Compare the installed plugin version against the range the sources give (from n/a through 7.1.2).","plain_action":"","product_name":"wpjam-basic","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running the WPJAM Basic plugin (wpjam-basic) up to and including 7.1.2. Sites without this plugin are not affected. The sources do not say which settings or pages are needed to trigger it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4556,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vulnerable code path from the NVD entry or the vendor's plugin page; the sources give only 'through 7.1.2'.","search":"'-125443':14A,17A '-2026':13A,16A '7.1.2':106C 'affect':100C 'allow':94C 'attack':52B 'base':7A,46B,97C 'basic':2A,20A,25B,28B,90C,93C,102C 'browser':69B 'build':40B 'craft':60B 'cross':48B,83C 'cross-sit':47B,82C 'cve':12A,15A 'denishua':33B,88C 'dom':6A,45B,96C 'dom-bas':5A,44B,95C 'enabl':43B 'fail':34B 'generat':81C 'get':54B 'handl':11A 'improp':74C 'input':10A,37B,77C 'issu':99C 'load':58B 'n/a':104C 'neutral':36B,75C 'packag':21B 'page':42B,61B,80C 'plugin':4A,31B 'run':63B 'script':50B,64B,85C 'session':70B 'site':49B,73B,84C 'visitor':56B,67B 'vulner':86C 'web':41B,79C 'wordpress':3A,22B,30B 'wpjam':1A,19A,24B,27B,89C,92C,101C 'wpjam-bas':23B,91C 'wpjam-basic':18A 'xss':8A,26B 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WPJAM Basic plugin (wpjam-basic) up to and including 7.1.2. Sites without this plugin are not affected. The sources do not say which settings or pages are needed to trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpjambasic"],"ptokens":["basic","wpjam"],"labels":["high","package","vendor","wordpress","wpjambasic","xss"],"campaign_type":null,"search_a":"'-125443':14A,17A '-2026':13A,16A 'base':7A 'basic':2A,20A 'cve':12A,15A 'dom':6A 'dom-bas':5A 'handl':11A 'input':10A 'plugin':4A 'wordpress':3A 'wpjam':1A,19A 'wpjam-basic':18A 'xss':8A","search_b":"'attack':52B 'base':46B 'basic':25B,28B 'browser':69B 'build':40B 'craft':60B 'cross':48B 'cross-sit':47B 'denishua':33B 'dom':45B 'dom-bas':44B 'enabl':43B 'fail':34B 'get':54B 'input':37B 'load':58B 'neutral':36B 'packag':21B 'page':42B,61B 'plugin':31B 'run':63B 'script':50B,64B 'session':70B 'site':49B,73B 'visitor':56B,67B 'web':41B 'wordpress':22B,30B 'wpjam':24B,27B 'wpjam-bas':23B 'xss':26B","search_c":"'7.1.2':106C 'affect':100C 'allow':94C 'base':97C 'basic':90C,93C,102C 'cross':83C 'cross-sit':82C 'denishua':88C 'dom':96C 'dom-bas':95C 'generat':81C 'improp':74C 'input':77C 'issu':99C 'n/a':104C 'neutral':75C 'page':80C 'script':85C 'site':84C 'vulner':86C 'web':79C 'wpjam':89C,92C,101C 'wpjam-bas':91C 'xss.this':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125443","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125443","severity":null,"published_at":"2026-11-15T14:17:24+00:00","modified_at":"2026-11-15T14:17:24+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125443:4045","url":"https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability","severity":null,"published_at":"2026-11-15T14:39:14+00:00","modified_at":"2026-11-15T14:39:14+00:00","first_seen_at":"2026-11-15T14:39:14+00:00","fetched_at":"2026-11-15T14:39:14+00:00","note":"Patchstack (CNA, third party, not the vendor) lists <=7.1.2 vulnerable, 7.1.4 patched, published 2026-11-11; no vendor advisory found, so nothing marked verified. Code path not published.","cites":["https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability","https://wordpress.org/plugins/wpjam-basic/"]}],"documents":[{"id":163840,"url":"https://patchstack.com/database/wordpress/plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-1-2-cross-site-scripting-xss-vulnerability","title":"Patchstack: WPJAM Basic <= 7.1.2 XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":163842,"url":"https://wordpress.org/plugins/wpjam-basic/","title":"WPJAM Basic - WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}