CVE-2026-9620

Name of the Vulnerable Software and Affected Versions WP Latest Posts versions prior to 5.0.12

Description The plugin is subject to Stored Cross-Site Scripting due to insufficient output escaping in the field() and loop() functions. These functions use a regular expression to extract the raw src attribute value from <img> tags within post content and reconstruct new <img> elements or CSS background-image declarations by directly concatenating the unescaped value. This process bypasses WordPress's kses filtering, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that execute when a user accesses an affected page.

Recommendations Update to a version later than 5.0.11. As a temporary workaround, restrict author-level access to post content editing to minimize the risk of script injection.