WP Ghost CVE-2026-89051

Exploitation requires the target site to run WP Ghost (Hide My WP Ghost) version 7.0.12 or earlier with the affected code path reachable; the attacker needs no authentication (PR:N) to inject the payload via the 'replaceHeadersAndTags' function. The key limiting factor, per the description, is that payload execution depends on a victim clicking the injected link - i.e., user interaction is effectively needed to trigger the script despite the CVSS vector stating UI:N. Impact is confined to the victim's browser context (no availability impact); there is no indication a specific non-default plugin configuration is required.

This is a stored (persistent) XSS (CWE-79) in the WP Ghost / Hide My WP Ghost WordPress security plugin, reported by Wordfence, a credible source for WordPress vulnerability intelligence. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 High) indicates remote, low-complexity, unauthenticated exploitation with a scope change and partial confidentiality/integrity impact. However, there is a direct conflict between the CVSS vector and the description: the vector encodes UI:N (no user interaction), yet the description states the script executes 'whenever a user clicks on the injected link,' which implies user interaction (UI:R) is actually required - this should be verified, as it materially lowers real-world risk. No EPSS score, CISA KEV listing, SSVC decision data, or POC was supplied in the input; absence of these is not evidence either way, but there is no signal of active exploitation or published exploit code. Net assessment: a genuine and prioritizable issue for sites running the affected plugin because injection is unauthenticated, but it is not an automatable, no-interaction remote-code-execution-class flaw - impact is limited to script execution in a victim's browser (C:L/I:L, A:N) and, per the description, likely gated behind a victim clicking a crafted link. Treat as a prompt-patch item rather than an emergency.

An unauthenticated attacker submits input that is stored and later rendered unsanitized by the plugin's 'replaceHeadersAndTags' function, planting a malicious script in a page. When a visitor or administrator clicks the injected link, the script runs in their browser session, enabling session/cookie theft, redirection, or actions performed as the victim. No public exploit code was identified in the provided data.