WordPress Plugin Vulnerabilities

12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

Description

The plugin does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

Proof of Concept

Affects Plugins

Plugin icon
12-step-meeting-list
Fixed in 3.19.17

References

CVE
CVE-2026-78333

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Huseyn
Submitter
Huseyn
Verified
Yes
WPVDB ID
27de9242-d60e-42e8-a3a5-e355bfc00393

Timeline

Publicly Published
2026-08-25 (about 23 days ago)
Added
2026-08-25 (about 22 days ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-04-07
Title
Elementor Website Builder < 3.35.6 - Contributor+ Stored XSS via REST API
Published
2026-03-20
Title
iTracker360 < 2.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field
Published
2022-06-06
Title
Google Authenticator < 1.0.8 - Admin+ Stored Cross-Site Scripting
Published
2014-08-01
Title
WP Affiliate Manager < 1.1 - Reflected Cross-Site Scripting
Published
2024-01-17
Title
Advanced Custom Fields < 6.2.5 - Contributor+ Stored Cross-Site Scripting via Custom Field