Skip to content
Sign in
7.1 High

CVE-2026-9570 The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into…

Description

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

Affected products and versions

Product Affected versions Fixed in
Taskbuilder 5.0 earliest → < 5.0.8 5.0.8

Other CVEs of Taskbuilder

The 3 CVEs of Taskbuilder →
CVE-2024-9831 The Taskbuilder WordPress plugin before 3.0.9 does not sanitize and escape a parameter before using it in a SQL… 7.2 High CVE-2024-9828 The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it… 4.1 Medium
Track this CVE