{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awpghosthide_my_wp_ghostwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpghost:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-89051"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Hide My WP Ghost (\u003c= 7.0.12)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WP Ghost"],"content_html":"\u003cp\u003eThe Hide My WP Ghost (Security \u0026amp; Firewall) plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists within the 'replaceHeadersAndTags' function, which fails to properly sanitize user-supplied input or escape output before rendering it on the page. This vulnerability affects all versions of the plugin up to, and including, 7.0.12. An unauthenticated attacker can leverage this weakness to inject arbitrary web scripts into the site's content. When an unsuspecting user navigates to the compromised page or interacts with the injected link, the malicious script executes within the user's browser context. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious domains. Organizations utilizing this plugin should prioritize updating to the latest secure version once available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users, including site administrators. Successful exploitation can result in complete account takeover, sensitive data exfiltration from the WordPress dashboard, or the injection of malicious content designed to infect site visitors. This poses a significant risk to the integrity and confidentiality of the WordPress installation and its user base.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit WordPress site access logs for suspicious HTTP POST requests directed toward plugin-specific endpoints.\u003c/li\u003e\n\u003cli\u003eImplement a Web Application Firewall (WAF) to block requests containing common XSS payloads, such as script tags or event handlers, targeting known vulnerable plugin patterns.\u003c/li\u003e\n\u003cli\u003eUpgrade the Hide My WP Ghost plugin to a version later than 7.0.12 immediately upon vendor release.\u003c/li\u003e\n\u003cli\u003eEnforce Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, mitigating the impact of successful XSS injections.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:28:44Z","date_published":"2026-10-16T06:28:44Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-ghost-xss/","summary":"Unauthenticated attackers can exploit insufficient input sanitization in the Hide My WP Ghost plugin to inject persistent malicious scripts into WordPress pages.","title":"Stored Cross-Site Scripting in Hide My WP Ghost WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-ghost-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wpghost:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}