Live › vulnerability › CVE-2026-89051
Go to dashboardThe WP Ghost (Hide My WP Ghost) security plugin for WordPress fails to sanitize and escape input in its replaceHeadersAndTags function, up to and including version 7.0.12. An unauthenticated attacker can store JavaScript that runs in a visitor's browser when they click the injected link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP Ghost (Hide My WP Ghost) plugin at version 7.0.12 or earlier are exposed, because the flaw is reachable without logging in. Sites without this plugin installed are not affected. The sources do not say whether non-default settings are needed.
No product ranges from the sources yet.
wp plugin get ghost --field=version if the plugin slug is ghost; unknown if the slug differs.7.0.12.7.0.12; the sources do not name the patched version, so unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.
This page as .md · .json · in your agent: get_signal("CVE-2026-89051")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.