CVE-2026-77820

Name of the Vulnerable Software and Affected Versions WPComplete versions prior to 2.9.9.1

Description The pro version of the WPComplete plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping when handling the empty shortcode attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version newer than 2.9.9.0.