Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject Webling forms and memberlists with arbitrary web scripts that will execute whenever an administrator views the related form or memberlist area of the WordPress admin.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-11 | 1 | General1 |
| 2026-04-19 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-1263-webling-version-3-9-0-medium-vulnerability-proof-of-concept CVE-2026-1263 #WordPress plugin #vulnerability webling #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2026‑1263 targeting the Webling WordPress plugin is linked, indicating that the vulnerability has been demonstrated publicly.
⚡ New CVE Alert: CVE-2026-1263 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-1263 #CVE-2026-1263 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/oKfF2aBVa7
Post summary
The tweet merely announces a new CVE with severity and affected product details, lacking deeper technical or exploit information.
CVE-2026-1263 The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insuff… https://www.cve.org/CVERecord?id=CVE-2026-1263
Post summary
An announcement identifies a stored XSS flaw in Webling WordPress plugin (v3.9.0 and earlier) caused by inadequate input sanitization, with no PoC, exploit, patch, or active exploitation details provided.