Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

Ansar Import plugin lets attackers run code on visitor browsers

CVE-2026-39778 · published 29 days ago
Summary

The Ansar Import – One Click Starter Sites – for Elementor & Themes plugin for WordPress (versions up to 2.1.2) can be tricked into running malicious scripts without any login. This means a visitor to a site using the plugin could have harmful code executed in their browser, potentially stealing information or taking over their session. Upgrade the plugin to a newer version or disable it until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
themeansar ansar import – one click starter sites – for elementor &amp; themes <= 2.1.2
Original advisory text
WordPress Ansar Import – One Click Starter Sites – for Elementor & Themes plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published6 Oct 2026
Updated26 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-39778 · NVD
CVE-2026-39778 · MITRE
Track software like this
Free during beta