CVE-2026-2466

The DukaPress WordPress plugin through version 3.2.4 fails to sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability [1]. This flaw allows an attacker to inject arbitrary JavaScript into a response that is immediately reflected to the user.

To exploit this, an attacker crafts a malicious URL containing the unsanitized parameter. The victim, typically a high-privilege user such as an administrator, must be logged into the WordPress site and click the crafted link. No prior authentication is required for the attacker, but the victim must have an active session [1].

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, privilege escalation, or performing administrative actions on behalf of the victim, potentially compromising the entire WordPress installation [1].

As of the publication date, no official fix is available for this vulnerability. Users are advised to disable the DukaPress plugin or implement a web application firewall rule to block malicious requests until a patch is released [1].