CVE-2026-0681

Name of the Vulnerable Software and Affected Versions Extended Random Number Generator versions prior to 1.2

Description The Extended Random Number Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin settings. Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue specifically impacts multi-site installations and those where unfiltered html has been disabled.

Recommendations Update Extended Random Number Generator to version 1.2 or later.