Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-81742: BE REST Endpoints plugin lets anyone add malicious scripts
CVE-2026-81742 · published 1 month ago
Summary
The BE REST Endpoints plugin for WordPress does not check who is making changes to widgets, so anyone on the internet can read, create, modify, or delete them. Because the plugin also fails to clean the data it stores, an attacker can insert harmful code that runs in visitors' browsers. Update or remove the plugin, or apply a patch that adds proper permission checks and data cleaning.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | be rest endpoints | <= 1.0.0 |
Original advisory text
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it s...
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
8.8
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Sep 2026
Updated4 Nov 2026
First seen12 Sep 2026
Track software like this
Free during beta