Skip to content
Sign in
4.8 Medium

CVE-2026-9577 The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before…

Description

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.

Affected products and versions

Product Affected versions Fixed in
Post Status Notifier Lite 1.13 earliest → < 1.13.0 1.13.0

Other CVEs of Post Status Notifier Lite

The 2 CVEs of Post Status Notifier Lite →
CVE-2022-4325 The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before… 6.1 Medium
Track this CVE