PT-2026-34301

CVE-2026-4353

·

Published

2026-04-21

·

Updated

2026-05-01

Description by

CVSS 3.1
6.4
Medium
MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions CI HUB Connector versions prior to 1.2.107
Description The CI HUB Connector plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping within the 'id' attribute of the cihub metadata shortcode. These scripts execute whenever a user visits the affected page.
Recommendations Update to a version later than 1.2.106.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-4353
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com