WordPress Plugin Vulnerabilities

Hostinger Reach 1.0.6 - 1.8.2 - Contributor+ Stored XSS via formId Elementor Widget Attribute

Description

The plugin does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.

Proof of Concept

Affects Plugins

Plugin icon
hostinger-reach
Fixed in 1.8.3

References

CVE
CVE-2026-87777

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Dmitrii Ignatyev
Submitter
Dmitrii Ignatyev
Submitter website
https://research.cleantalk.org/
Verified
Yes
WPVDB ID
4a1f5c2b-a6e5-4e6f-afa3-79726d0eb1e3

Timeline

Publicly Published
2026-09-28 (about 2 days ago)
Added
2026-09-28 (about 1 day ago)
Last Updated
2026-09-28 (about 1 day ago)

Other

Published
Title
Published
2023-10-24
Title
CallRail Phone Call Tracking < 0.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2024-06-05
Title
Materialis Companion < 1.3.42 - Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode
Published
2025-10-03
Title
Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS
Published
2026-08-28
Title
Geotargeting WP < 3.5.6.2 - Reflected XSS
Published
2023-12-27
Title
WP Review Slider < 12.8 - Authenticated (Administrator+) Stored Cross-Site Scripting