CVE-2026-1945Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 4 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

4 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 4 classified signals
4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Full discourse4 posts

CVEarity@CVEarity218d
Disclosure
⚡ New CVE Alert: CVE-2026-1945 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-1945 #CVE-2026-1945 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/3hTT7MGT16
Post summary
The tweet announces CVE-2026-1945 with a severity score of 7.2 affecting WordPress, but provides no technical details, PoC, or exploit information.
0000035
64 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds218d
Disclosure
CVE-2026-1945 Stored XSS Vulnerability in WPBookit WordPress Plugin via User Parameters https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1945
Post summary
A stored XSS vulnerability (CVE-2026-1945) was disclosed in the WPBookit WordPress plugin, affecting user parameters.
0000050
4.0K followersView on X
Infoflowcloud@infoflowcloud218d
Disclosure
🚨*CVE* CVE-2026-1945 The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and includ… https://www.cve.org/CVERecord?id=CVE-2026-1945 ----- Traducción: CVE-2026-1945 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-1945, a stored XSS flaw in the WPBookit WordPress plugin, providing basic technical details but no PoC, exploit, or patch information.
0000028
55 followersView on X
CVE@CVEnew218d
Disclosure
CVE-2026-1945 The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb_user_name' and 'wpb_user_email' parameters in all versions up to, and includ… https://www.cve.org/CVERecord?id=CVE-2026-1945
Post summary
The WPBookit plugin is disclosed to have a stored XSS flaw via specific parameters; no PoC, exploit, or patch information is included.
00000514
56.6K followersView on X

Explore more

Back to dashboard