CVE-2026-57762

The Simple URLs plugin for WordPress version 151 and earlier contains a Stored Cross Site Scripting (XSS) vulnerability. An author can inject a malicious script that will be executed in the browser of an administrator or other user.

The risk involves potential session hijacking of an administrator, data theft, or unauthorized actions within the WordPress panel. An attacker with author privileges can exploit this vulnerability for privilege escalation or malware distribution.

Immediately update the Simple URLs plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin until a patch is released.