EUVD-2026-21248Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject Webling forms and memberlists with arbitrary web scripts that will execute whenever an administrator views the related form or memberlist area of the WordPress admin.
AnalysisAI
Stored Cross-Site Scripting (XSS) in the Webling WordPress plugin versions up to 3.9.0 allows authenticated attackers with Subscriber-level access to inject malicious scripts into forms and memberlists that execute when administrators view the admin interface. The vulnerability stems from insufficient input sanitization and output escaping in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions, combined with missing capability checks. No public exploit code or active exploitation has been reported at time of analysis.
Technical ContextAI
The Webling plugin for WordPress (CPE: cpe:2.3:a:usystemsgmbh:webling:*:*:*:*:*:*:*:*) contains a Stored Cross-Site Scripting vulnerability classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause involves three security gaps in the admin form and memberlist handling functions: first, insufficient sanitization of user-supplied input when forms and memberlists are saved; second, inadequate HTML entity encoding when these inputs are displayed back in the WordPress admin dashboard; and third, missing permission checks that should restrict these functions to high-privilege roles only. Because the vulnerable code paths accept data from Subscriber-level users but fail to properly sanitize or escape before storage and display, any authenticated user at the lowest permission tier can plant persistent malicious JavaScript that activates whenever an administrator accesses the affected admin pages, potentially leading to credential theft, admin account compromise, or further WordPress installation compromise.
RemediationAI
Vendor-released patch: Webling 3.9.1. WordPress administrators should immediately update the Webling plugin to version 3.9.1 or later via the WordPress admin dashboard (Plugins > Installed Plugins > Webling > Update Now) or manually via plugins.wordpress.org. Organizations unable to update immediately should restrict Webling form and memberlist admin pages to high-privilege users only via WordPress user role management, though this does not eliminate the risk to existing Subscriber accounts. Verify that all user accounts with Subscriber or higher roles are legitimate and review the WordPress audit log (if available via security plugins) for suspicious form or memberlist modifications. The vulnerability details and patch are documented in the Wordfence threat intelligence report linked in the advisory.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today