Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Wp Js Detect <= 1.0.9: Unauthenticated Plugin Settings Updates

CVE-2026-9731 · published 3 months ago
Summary

The Wp Js Detect plugin for WordPress is at risk because an attacker can trick a site administrator into making changes to the plugin's settings. This could allow the attacker to add unwanted content to the site. Update the plugin to a version higher than 1.0.9 to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpkuf wp js detect <= 1.0.9
Original advisory text
Wp Js Detect <= 1.0.9 - Cross-Site Request Forgery to Plugin Settings Update
The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce validation on the plugin_settings function. This makes it possible for unauthenticated attackers to update the plugin's notification text and CSS settings (wp_non_js_notification_text and wp_non_js_notification_css), injecting arbitrary content that is echoed unescaped on the frontend via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published8 Jul 2026
Updated30 Oct 2026
First seen8 Jul 2026
Sources
CVE-2026-9731 · NVD
CVE-2026-9731 · MITRE
Track software like this
Free during beta