CVE-2026-1266

creationtimestamp| type| source ---|---|--- 2026-01-24 11:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md637jdath2n...

CVE-2026-1266

The Postalicious plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...