CVE-2026-113409
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
Risk Assessment
Stored XSS in the admin panel can execute arbitrary script in an administrator's session, risking account takeover and further privilege escalation.
Recommendation
Update the Ortto plugin to version 1.0.25 or later and restrict the ability to modify the plugin configuration to trusted users.
Other vulnerabilities in Ortto plugin for WordPress
Original NVD description (English source)
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS