Security Advisory

CVE-2026-39071

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-28 00:00:00

Last updated 2026-09-01 19:07:40

Assigner mitre

CVSS score 5.4

State PUBLISHED

Description

WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.

← Browse all CVEs View on cve.org ↗