WordPress Plugin Vulnerabilities

ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters

Description

The plugin does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

Proof of Concept

Affects Plugins

Plugin icon
prosolution-wp-client
Fixed in 2.0.11

References

CVE
CVE-2026-19055

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Nir Yehoshua
Submitter
Nir Yehoshua
Submitter website
https://ciphersecuritylabs.com
Verified
Yes
WPVDB ID
a1243ff3-3f0e-4068-a716-722e7cf4856b

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2023-05-22
Title
Easy Forms for Mailchimp < 6.8.9 - Reflected XSS
Published
2024-11-27
Title
Kudos Donations – Easy donations and payments with Mollie < 3.3.0 - Reflected Cross-Site Scripting via 'add_query_arg'
Published
2024-02-09
Title
Insert PHP Code Snippet < 1.3.5 - Admin+ Stored XSS
Published
2025-08-18
Title
Nexter Blocks < 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2025-02-02
Title
Visitor Details <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting