CVE-2026-116849

MediumCVSS 6.5

Published: 29/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 29/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The StreamCast plugin (up to version 2.4.6) contains a Stored Cross-site Scripting (XSS) vulnerability resulting from improper neutralization of input during web page generation. Malicious JavaScript code can be stored and executed in the victim's browser.

Risk Assessment

An attacker could persistently inject a script that executes for users visiting the page, potentially leading to session data theft or account takeover. The risk affects user data integrity and confidentiality.

Recommendation

Update the StreamCast plugin to the latest version (above 2.4.6). Also consider implementing CSP and regularly scanning the site for malicious scripts.

Other vulnerabilities in StreamCast

CVE-2026-62030High
Unauthenticated Server Side Request Forgery (SSRF) in the StreamCast plugin up to version 2.4.5. An attacker can send requests from the server to internal resources.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS