WordPress Plugin Vulnerabilities

ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

Description

The plugin does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
prosolution-wp-client
Fixed in 2.0.11

References

CVE
CVE-2026-19056

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
83ad2038-3755-40a5-a8af-e6fac94341d1

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2025-05-23
Title
Page Builder: Pagelayer – Drag and Drop website builder < 2.0.1 - Reflected Cross-Site Scripting via login_url Parameter
Published
2024-11-12
Title
Constant Contact Forms by MailMunch < 2.1.3 - Reflected Cross-Site Scripting
Published
2026-08-07
Title
Easy Accordion < 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute
Published
2025-04-01
Title
Turisbook Booking System <= 1.3.8 - Contributor+ Stored XSS
Published
2016-08-01
Title
Booking Calendar <= 6.2 - Reflected Cross-Site Scripting (XSS)