CVE-2026-81742

The BE REST Endpoints WordPress plugin through 1.0.0 allows unauthenticated users to read, create, update, and delete widgets without any authorization check. Additionally, the plugin fails to sanitize stored widget values , enabling injection of arbitrary web scripts that execute in the browser ...