CVE-2026-84816

CVE-2026-84816 is an unauthenticated cross-site scripting (XSS) flaw in the WPCS plugin for WordPress, affecting all versions up to and including 1.3.2. Because no authentication is required, any remote attacker can potentially trigger it by getting crafted input processed by the plugin so that it is rendered in a victim's browser without proper sanitization; the specific vulnerable parameter is not documented in the available data. Successful exploitation would let an attacker run arbitrary JavaScript in the context of a visitor's or administrator's session, enabling actions such as redirecting users, altering displayed content, or acting on the victim's behalf, with confidentiality, integrity, and availability impacts rated low and a changed scope per the CVSS metrics. Any WordPress installation running WPCS version 1.3.2 or earlier is affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.

What to do: Update WPCS to a release newer than 1.3.2 as soon as a patched version is available, since the advisory data does not specify the exact fixed version. Until you can patch, deactivate the plugin or add WAF/virtual-patching rules that strip script tags and event-handler attributes from unauthenticated requests reaching the plugin's endpoints.