CVE-2026-13042

Name of the Vulnerable Software and Affected Versions RPB Chessboard versions prior to 8.1.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. Attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This occurs because the plugin's comment text() filter synthesizes attribute-breaking HTML at render time, bypassing WordPress's save-time kses sanitization by using allowed tags and attributes, such as <a> elements with title and href attributes.

Recommendations Update RPB Chessboard to version 8.1.3 or later.