CVE-2026-78333

Name of the Vulnerable Software and Affected Versions 12 Step Meeting List versions prior to 3.19.17

Description The plugin fails to sanitize and escape values submitted by unauthenticated users before they are stored in the activity log and subsequently displayed on an administrative page. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the server and executed in the browser of high-privilege users, such as administrators.

Recommendations Update the plugin to version 3.19.17 or later.