CVE-2026-81754Patch

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

DFIR Lab@DFIR_Lab46d
Patch
🚨 HIGH SEVERITY: CVE-2026-81754 CVSS 7.2 - WordPress Vigilant Security plugin (≤2.10.2) vulnerable to Stored XSS via User-Agent header. Unauthenticated attackers can inject malicious scripts through failed login attempts. Patch immediately! #CVE #Vulnerability #PatchNow https://t.co/b2tDCYQTGF
Post summary
The tweet discloses a high-severity stored XSS vulnerability in the WordPress Vigilant Security plugin (versions ≤2.10.2) and explicitly urges immediate patching.
0000045
138 followersView on X

Explore more

Back to dashboard