CVE-2026-81754

CVE-2026-81754 is a stored cross-site scripting (XSS) flaw in the Vigilant – 100% Free Security Suite plugin for WordPress, present in all versions up to and including 2.10.2, caused by insufficient input sanitization and output escaping of the HTTP User-Agent header. An unauthenticated attacker triggers it by sending a login attempt with a crafted User-Agent header; when the login fails, the injected web script is passively stored on the site with no further action required from the attacker. The stored script then executes in the browser of any user who views an injected page, letting the attacker run arbitrary web script content in the context of the site (CVSS 3.1: 7.2 High, scope-changed, low confidentiality/integrity impact). Any WordPress site running Vigilant 2.10.2 or earlier is affected, with the greatest risk on sites whose login form is reachable by anonymous internet visitors. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

What to do: Update the Vigilant plugin to the latest patched release (any version newer than 2.10.2) as soon as it is available and verify the installed version afterward. As interim mitigation, restrict or rate-limit access to the login endpoint, consider filtering failed login attempts with unusual User-Agent strings, and review stored content/pages for unexpectedly injected scripts. Prioritize sites where wp-login.php is exposed to the public internet, since any anonymous visitor can plant a payload via a failed login.