CVE-2026-89051
7.2HighPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated attackers can inject persistent web scripts that execute in visitors' browsers when they click an injected link. Attackers only need network access to the target WordPress site.
Root cause
The 'replaceHeadersAndTags' function fails to properly sanitize input and escape output.
Affected systems
WP Ghost (Hide My WP Ghost) WordPress plugin versions up to and including 7.0.12
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade the plugin to version 7.0.13 or later. If patching immediately is not possible, deactivate the WP Ghost plugin.
$ wp plugin update hide-my-wp --version=7.0.13AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.