WordPress Plugin Vulnerabilities

IPGP Visitors Origin < 1.6 - Reflected XSS

Description

The plugin does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
ipgp-visitors-origin
Fixed in 1.6

References

CVE
CVE-2026-81404

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Vuln Seeker Cyber Security Team
Submitter
Vuln Seeker Cyber Security Team
Submitter website
https://vulnseeker.org/
Verified
Yes
WPVDB ID
8fbfb296-78d8-4f3b-ab21-7a5a4e0ea421

Timeline

Publicly Published
2026-09-03 (about 2 days ago)
Added
2026-09-03 (about 1 day ago)
Last Updated
2026-09-03 (about 1 day ago)

Other

Published
Title
Published
2024-05-06
Title
WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-09-05
Title
Parallax Scrolling Enllax.js <= 0.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-10-25
Title
User Avatar < 1.4.12 - Reflected XSS
Published
2024-03-14
Title
Elements Plus! < 2.16.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
Published
2023-01-27
Title
Greenshift < 5.0 - Contributor+ Stored XSS