{"id":"CVE-2026-125791","kind":"vulnerability","aliases":["CVE-2026-125791"],"related":[],"title":"Orphans sierotki WordPress plugin: stored XSS through 3.4.6","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6.","summary":"The Orphans (sierotki) plugin by iWorks fails to sanitize input before writing it into web pages, enabling stored cross-site scripting. An attacker who can store content can run scripts in other visitors' browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Orphans (sierotki) plugin is installed and its version, in the plugin list of the WordPress admin.\n- Confirm the installed version against the affected range `3.4.6` and earlier.","fix":"- Fixed version: unknown; the sources do not name one.","status":"open","published_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:26+00:00","updated_at":"2026-11-15T14:37:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-15T14:37:26Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed version: unknown; the sources do not name one.","reach":"internet","title":"Orphans sierotki WordPress plugin: stored XSS through 3.4.6","impact":"medium","summary":"The Orphans (sierotki) plugin by iWorks fails to sanitize input before writing it into web pages, enabling stored cross-site scripting. An attacker who can store content can run scripts in other visitors' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers, session tokens may be stolen","analyst_note":"Confirm the affected plugin source, required privilege level, and whether a fixed version exists at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-125791.","how_to_check":"- Check whether the Orphans (sierotki) plugin is installed and its version, in the plugin list of the WordPress admin.\n- Confirm the installed version against the affected range `3.4.6` and earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Orphans (sierotki) plugin at version 3.4.6 or earlier, where the stored input reaches page output. Sites without this plugin are not affected. The sources do not say which roles can store the input.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000739,"input_tokens":4541,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125791':11A,14A '-2026':10A,13A '3.4.6':8A,81C 'affect':76C 'allow':72C 'attack':43B 'browser':54B 'content':47B 'cross':39B,64C 'cross-sit':38B,63C 'cve':9A,12A 'enabl':36B 'fail':26B 'generat':62C 'host':18B 'improp':55C 'input':29B,58C 'issu':75C 'iwork':25B,69C 'n/a':79C 'neutral':56C 'orphan':1A,21B,70C,77C 'packag':15B 'page':35B,61C 'plugin':4A,23B 'run':49B 'sanit':28B 'script':41B,50B,66C 'self':17B 'self-host':16B 'sierotki':2A,22B,71C 'site':40B,65C 'store':5A,37B,46B,73C 'visitor':53B 'vulner':67C 'web':34B,60C 'wordpress':3A,19B 'write':31B 'xss':6A 'xss.this':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Orphans (sierotki) plugin at version 3.4.6 or earlier, where the stored input reaches page output. Sites without this plugin are not affected. The sources do not say which roles can store the input.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-125791':11A,14A '-2026':10A,13A '3.4.6':8A 'cve':9A,12A 'orphan':1A 'plugin':4A 'sierotki':2A 'store':5A 'wordpress':3A 'xss':6A","search_b":"'attack':43B 'browser':54B 'content':47B 'cross':39B 'cross-sit':38B 'enabl':36B 'fail':26B 'host':18B 'input':29B 'iwork':25B 'orphan':21B 'packag':15B 'page':35B 'plugin':23B 'run':49B 'sanit':28B 'script':41B,50B 'self':17B 'self-host':16B 'sierotki':22B 'site':40B 'store':37B,46B 'visitor':53B 'web':34B 'wordpress':19B 'write':31B","search_c":"'3.4.6':81C 'affect':76C 'allow':72C 'cross':64C 'cross-sit':63C 'generat':62C 'improp':55C 'input':58C 'issu':75C 'iwork':69C 'n/a':79C 'neutral':56C 'orphan':70C,77C 'page':61C 'script':66C 'sierotki':71C 'site':65C 'store':73C 'vulner':67C 'web':60C 'xss.this':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125791","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125791","severity":null,"published_at":"2026-11-15T14:17:25+00:00","modified_at":"2026-11-15T14:17:25+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}