CVE-2026-42750
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The WPComplete plugin (through 2.9.5.4) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. Malicious code can be stored and executed in a user's browser.
Risk Assessment
An attacker can store a script that executes in the session of an administrator or users, potentially leading to session hijacking or data modification. This affects the security of the WordPress site.
Recommendation
Update the WPComplete plugin to a version later than 2.9.5.4. Consider additional input filtering and CSP deployment.
Other vulnerabilities in WPComplete
See all- CVE-2026-66479High
A Cross-Site Request Forgery (CSRF) vulnerability in WPComplete from Liquid Web / StellarWP allows Stored XSS. This issue affects WPComplete from n/a through 2.9.5.6.
- CVE-2026-77820Medium
The WPComplete plugin for WordPress (versions up to and including 2.9.9.0) is vulnerable to Stored Cross-Site Scripting via the 'empty' Shortcode Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This requires the premium version of the software. Please note this only affects the pro version.
- CVE-2026-66599High
Unauthenticated Cross Site Scripting (XSS) in WPComplete versions up to 2.9.5.6. Allows injecting malicious script into the page.
- CVE-2025-49906Medium
The WPComplete plugin has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Affects versions up to and including 2.9.5.3.
- CVE-2025-58974Medium
The WPComplete WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 2.9.5.2.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS