What is the CVSS score of CVE-2026-10092?

CVE-2026-10092 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Cincopa WordPress Plugin are affected by CVE-2026-10092?

The Cincopa WordPress plugin (versions ≤1.163) contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious code through comments, compromising all…

How to fix or mitigate CVE-2026-10092?

Within 24 hours: Inventory all WordPress installations running Cincopa ≤1.163; disable user comments on posts containing Cincopa shortcodes or restrict commenting to authenticated, pre-approved users. Within 7 days: Contact Cincopa vendor to confirm patch availability and timeline; implement Web Application Firewall rules blocking script injection attempts in comment submissions; audit recent comments for evidence of malicious payloads. Within 30 days: Complete historical audit of all comments for injected JavaScript; deploy Content Security Policy headers with restricted script-src directives; if no vendor patch released, remove or replace Cincopa plugin.

Cincopa WordPress Plugin CVE-2026-10092

EUVD-2026-38662 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-jhg4-5fww-9vvr

XSS WordPress Cincopa Video And Media Plug In

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated comment submission (PR:N) plants the payload, but a victim must load the comments page (UI:R); stored XSS crosses scope to the browser (S:C) with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:55 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.2

DescriptionCVE.org

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because the plugin processes the [cincopa] shortcode via a comment_text filter hook, allowing unauthenticated visitors who can post comments to supply a malicious shortcode argument that persists in the database.

Articles & Coverage 2

medium.com CVE-2026-10092: Unauthenticated Stored XSS in Cincopa WordPress Video Plugin via Comment Shortcodes Jul 05, 2026 News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Stored cross-site scripting in the Cincopa video and media plug-in for WordPress (versions ≤1.163) allows unauthenticated commenters to inject persistent JavaScript via the [cincopa] shortcode processed by the comment_text filter. Any visitor or administrator viewing the affected post executes the attacker's script in their browser session. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in wp-media-cincopa.php (lines 166, 179, 330) of the video-playlist-and-gallery-plugin, where the plugin registers the [cincopa] shortcode against WordPress's comment_text filter hook. Because shortcodes embedded in comment bodies are expanded server-side without sanitizing shortcode attributes, attacker-controlled argument values are rendered into post HTML unescaped. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) caused by trusting shortcode parameters supplied through an authentication-optional input surface (comments).

RemediationAI

No vendor-released patch identified at time of analysis; monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2d6304e5-7fbf-484d-b147-f2a6c2ee0658) and the plugin's WordPress.org page for a release above 1.163. As compensating controls, disable the Cincopa plugin on sites that accept unauthenticated comments, or require comment moderation/account registration for commenting (Settings → Discussion → 'Comment must be manually approved' and 'Users must be registered and logged in to comment'), which prevents the malicious shortcode from being persisted before review. Site operators may also block the literal '[cincopa' string in comment submissions via a WAF rule (e.g., Wordfence custom rule) - note this side-effects legitimate use of the shortcode in comments. As a last resort, remove the plugin entirely and use an alternative video gallery solution until a fix is shipped.