CVE-2026-89051

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-89051

The Hide My WP Ghost (WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 7.0.12 . The root cause is insufficient input sanitization and output escaping within the replaceHeadersAndTags function. This flaw allows ...

CVE-2026-89051 Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-102674

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for...