CVE-2026-1278

Name of the Vulnerable Software and Affected Versions Mandatory Field plugin for WordPress versions prior to 1.6.9

Description The Mandatory Field plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the Mandatory Field plugin to version 1.6.9 or later.