PT-2026-26804

CVE-2026-1278

Published

2026-03-20

Updated

2026-03-21

Description by

CVSS 3.1

4.4

Medium

MetricsAV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mandatory Field plugin for WordPress versions prior to 1.6.9

Description The Mandatory Field plugin for WordPress is susceptible to Stored Cross-Site Scripting through admin settings. Insufficient input sanitization and output escaping allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update the Mandatory Field plugin to version 1.6.9 or later.

Exploitability

Fix

Impacts

Researchers

Bhumividh Treloges

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2026-1278