Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Dealia – Request a Quote plugin: Malicious Code Can Be Injected

CVE-2026-2718
Summary

The Dealia – Request a Quote plugin for WordPress is open to a security risk that allows attackers to inject malicious code into pages. This can happen when a user with contributor-level access or above makes changes to the plugin. To protect your site, update the plugin to the latest version.

Original title
The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.6. This is due to the use of ...
Original description
The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.6. This is due to the use of `wp_kses()` for output escaping within HTML attribute contexts where `esc_attr()` is required. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
nvd CVSS3.1 6.4
Vulnerability type
CWE-79 Cross-site Scripting (XSS)
Published: 19 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026