CVE-2026-2502

Name of the Vulnerable Software and Affected Versions xmlrpc attacks blocker plugin for WordPress versions prior to 1.1

Description The xmlrpc attacks blocker plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs due to the plugin trusting and logging attacker-controlled data from the X-Forwarded-For HTTP header, and then rendering debug log entries without proper output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.

Recommendations Update the xmlrpc attacks blocker plugin to version 1.1 or later.