What is the CVSS score of CVE-2026-1450?

CVE-2026-1450 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

rognone WordPress Plugin CVE-2026-1450

EUVD-2026-33889 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Wordfence

GHSA-9g4g-w5pv-xf7q

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:46 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the rognone WordPress plugin (versions ≤ 0.6.2) exposes visitors of affected sites to arbitrary JavaScript injection via the unsanitized 'mode' URL parameter in header.php. Unauthenticated remote attackers (PR:N per CVSS) can deliver a malicious link that, when clicked by a victim, executes attacker-controlled scripts in the victim's browser within the changed scope (S:C) of the WordPress application context. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the trivial attack complexity (AC:L) and zero authentication requirement lower the bar for opportunistic abuse.

Technical ContextAI

The rognone plugin (CPE: cpe:2.3:a:federicocarrara:rognone:*:*:*:*:*:*:*:*), authored by federicocarrara, processes the 'mode' GET parameter in header.php at line 71 without applying WordPress-standard output escaping functions such as esc_attr() or esc_html(). This is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) defect: user-controlled input is read from the request, insufficiently sanitized server-side, and reflected directly into the HTML response body. Because the flaw is in a shared header include, any page that loads this header while passing the 'mode' parameter is a potential reflection point. The WordPress plugin Trac source confirms the vulnerable line across both the trunk and the 0.6.2 tagged release.

RemediationAI

No vendor-released patched version has been confirmed in the available data - the CPE wildcard covers all versions through 0.6.2 with no fixed release identified. WordPress administrators should immediately deactivate and remove the rognone plugin until a patched version is published by the author; plugin removal eliminates the attack surface entirely with no functional trade-off beyond losing plugin functionality. As a compensating control while awaiting a patch, deploying a WAF rule (e.g., via Wordfence Security plugin or a network-layer WAF) that blocks or sanitizes the 'mode' parameter on requests to rognone-served endpoints can neutralize the reflected payload delivery; note that overly broad WAF rules may generate false positives on legitimate query strings. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb70d40-b1c1-456e-9207-66b6e91969eb and the WordPress plugin repository for a patched release.