WordPress Plugin Vulnerabilities

Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta

Description

The plugin does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.

Proof of Concept

Affects Plugins

Plugin icon
cc-addon-pack
No known fix

References

CVE
CVE-2026-17010

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
testoun
Submitter
testoun
Verified
Yes
WPVDB ID
1e760dbf-7efc-4511-9a05-2d1476eb3dfb

Timeline

Publicly Published
2026-08-05 (about 4 days ago)
Added
2026-07-29 (about 11 days ago)
Last Updated
2026-07-29 (about 11 days ago)

Other

Published
Title
Published
2024-03-07
Title
Premium Addons PRO < 2.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module
Published
2023-02-15
Title
JSON Content Importer < 1.3.16 - Admin+ Stored XSS
Published
2025-01-16
Title
GravityForms < 2.9.2 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
Published
2024-04-05
Title
Royal Elementor Addons < 1.3.95 - Contributor+ Stored Cross-Site Scriting
Published
2024-05-14
Title
Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg < 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting