CVE-2026-111068
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Exploitation requires an administrator to run the plugin's block-conversion migration ("Scan & Convert Blocks" during deactivation), which triggers the vulnerable build_group_block() function.
Risk Assessment
An attacker with a Contributor account can inject malicious scripts that execute in the browser of an administrator or other users, potentially leading to session hijacking or data theft. However, it requires an administrator action, limiting the attack vector.
Recommendation
Update the plugin to a version later than 2.11.0. Avoid running the block-conversion migration until updated and exercise caution when viewing content from low-privileged users.
Related vulnerabilities
- CVE-2026-121609Critical
A vulnerability was identified in the Qihoo 360 Whole Home Router M5 version 4.0.17.1566 within the boot script /etc/init.d/mpt (Home function). The issue involves hard-coded credentials. The exploit is publicly available and remote exploitation is possible.
- CVE-2026-121607Critical
A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to version 6.4.9 in the testspeed_command function of /fs2/bin/iscm. Manipulating the host argument results in OS command injection. The attack can be initiated remotely and the exploit has been made public.
- CVE-2026-121606Critical
A vulnerability was found in Qihoo 360 devices (models D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9) in the verify_sign function of fs2/bin/iscm responsible for firmware signature verification. Manipulating the sign argument leads to improper verification of cryptographic signatures. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-121600Critical
A vulnerability was found in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setMacFilterRules function of /cgi-bin/cstecgi.cgi handling MAC filtering. Manipulating the addEffect argument causes a stack-based buffer overflow. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-121599Critical
A vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the setWiFiMultipleConfig/delWiFiMultipleConfig functions of /cgi-bin/cstecgi.cgi handling Multi-SSID configuration. Manipulating the wepkey2/wepkey3 arguments results in a stack-based buffer overflow. The attack can be launched remotely and the exploit is now public.
- CVE-2026-121598Critical
A security vulnerability was detected in TOTOLINK A950RG version 4.1.2cu.5268_B20221104 in the strcpy function of /cgi-bin/cstecgi.cgi handling basic wireless configuration. Manipulating the wepkey argument leads to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.
- CVE-2026-92190Critical
Quest Foglight for Databases contains a deserialization of untrusted data vulnerability in the baseRmiServiceExporter component. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92189Critical
In Quest Foglight for Databases, the writeTopologySectionToFile method does not validate a user-supplied path before using it in file operations. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-92188Critical
The ForgeMBeanServerSupport module in Quest Foglight for Databases lacks authentication before allowing access to functionality. An unauthenticated remote attacker can execute arbitrary code in the context of SYSTEM.
- CVE-2026-121597Critical
In TOTOLINK A950RG version 4.1.2cu.5268_B20221104, the setAppEasyWizardConfig function in /cgi-bin/cstecgi.cgi mishandles the functionType argument, leading to a stack-based buffer overflow. The attack can be performed remotely and a public exploit is available.
Original NVD description (English source)
The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to run the plugin's block-conversion migration ("Scan & Convert Blocks" during deactivation), which triggers the vulnerable build_group_block() function and promotes the dormant payload from a block delimiter comment into live post_content HTML. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS