CVE-2026-6690

The CVE-2026-6690 entry details a Stored Cross-Site Scripting vulnerability in LifePress for WordPress, affecting all versions up to 2.2.2. The issue stems from the wp_ajax_nopriv_lp_update_mds action being registered without nonce verification or capability checks and from insufficient input san...

CVE-2026-6690: Improper Neutralization of Input During Web Page Generation

The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lpupdatemds AJAX action in all versions up to, and including, 2.2.2. This is due to the wpajaxnoprivlpupdatemds action being registered without nonce verification or capability checks,...