CVE-2026-81754

Name of the Vulnerable Software and Affected Versions The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress versions prior to 2.10.3

Description Stored Cross-Site Scripting (XSS) occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages by triggering a failed login attempt using a crafted User-Agent header. These scripts execute automatically whenever a user accesses the affected page, requiring no further interaction from the attacker after the payload is stored.

Recommendations Update the plugin to a version newer than 2.10.2.