Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-0743: WordPress WP Content Permission Plugin: Administrator Privilege Attack Risk

CVE-2026-0743 · published 9 months ago

Summary

The WP Content Permission plugin for WordPress has a security weakness allowing a malicious admin to inject code that executes when users visit certain pages. This could lead to unauthorized actions or data theft. Update the plugin to a version above 1.2 to fix the issue.

Original advisory text

The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published4 Feb 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2026-0743 · NVD

Track software like this

Free during beta