CVE-2026-92712

Name of the Vulnerable Software and Affected Versions ReactPress – Create React App for WordPress versions prior to 3.4.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages. This happens because the permalink parameter is processed using sanitize url(), which fails to prevent the fetching of remote URLs. The response body of these URLs, including script tags and event-handler attributes, is then written directly to disk using the file put contents() function.

Recommendations Update ReactPress – Create React App for WordPress to version 3.4.1 or later. Avoid using the permalink parameter until the plugin is updated.