Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The WP-Clippy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `clippy` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-5505 Stored Cross-Site Scripting in WP-Clippy Plugin for WordPress Up to 1.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5505
Post summary
The statement announces a stored XSS vulnerability in the WP‑Clippy WordPress plugin, providing basic technical details but no PoC, exploit code, or patch information.
⚡ New CVE Alert: CVE-2026-5505 📊 Severity: 6.4 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-5505 #CVE-2026-5505 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/aFm7oZDL38
Post summary
A new WordPress vulnerability, CVE-2026-5505, has been announced with a medium severity score; no further technical or exploitation details are provided.