CVE-2026-89424

Name of the Vulnerable Software and Affected Versions Duplicate Post versions prior to 1.5.7

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue requires the site owner to have enabled User Level Permissions for the Subscriber role, granting access to the i saw this noti AJAX branch used to deliver the payload via the noti token parameter.

Recommendations Update to a version newer than 1.5.6. Restrict the use of the noti token parameter or disable User Level Permissions for the Subscriber role to prevent access to the i saw this noti AJAX branch.