CVE-2026-19056
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.
Risk Assessment
An attacker can hijack an administrator session, potentially leading to full compromise of the WordPress site.
Recommendation
Update the ProSolution WP Client plugin to version 2.0.11 or later. Educate administrators about the risk of clicking suspicious links.
Original NVD description (English source)
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.