Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-1824: Infomaniak Connect for OpenID plugin allows attackers to inject malicious scripts

CVE-2026-1824 · published 8 months ago

Summary

The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to a security threat that allows attackers to inject malicious scripts into web pages. This can happen if an attacker with contributor-level access or higher edits a page and includes a specific code snippet. To protect your website, update the plugin to the latest version.

Original advisory text

The Infomaniak Connect for OpenID plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'endpoint_login' parameter of the infomaniak_connect_generic_auth_url shortcode in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published7 Mar 2026

Updated2 Nov 2026

First seen7 Mar 2026

Sources

CVE-2026-1824 · NVD

Track software like this

Free during beta