CVE-2026-57656

Name of the Vulnerable Software and Affected Versions Hester Core versions prior to 1.1.9

Description The Hester Core plugin for WordPress contains a Stored Cross-Site Scripting (XSS) flaw. This occurs because the software fails to properly sanitize input and escape output. Authenticated attackers with author-level permissions or higher can inject arbitrary web scripts into pages, which then execute in the browser of any user who visits the affected page.

Recommendations Update Hester Core to a version newer than 1.1.8.