CVE-2026-24601

Vulnerability

Overview The vulnerability is a stored Cross-Site Scripting (XSS) in the Penci Pay Writer plugin by PenciDesign, affecting versions up to and including 1.5. The issue arises from improper neutralization of user input during web page generation, allowing arbitrary script injection.

Exploitation

Conditions An attacker must have a user role with the ability to submit input (e.g., author or contributor). The injected payload is stored and executed when a victim, such as an administrator or site visitor, accesses the affected page. User interaction is required for the attack to succeed, typically via clicking a link or visiting a crafted page [1].

Impact

Successful exploitation enables the attacker to inject malicious scripts, including redirects, advertisements, and other HTML payloads. These scripts execute in the context of the victim's browser, potentially leading to session hijacking, defacement, or further compromise of the WordPress site [1].

Mitigation

Users are urged to update the Penci Pay Writer plugin to a version beyond 1.5 as soon as possible. If updating is not feasible, contacting the hosting provider or a web developer for security measures is recommended [1].