CVE-2026-92967

Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3

Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application reads the keyword parameter from the $ GET array and applies sanitize text field(), which removes HTML tags but preserves double quotes. The value is then inserted into the value attribute of a search input using a PHP heredoc without the use of esc attr(). Unauthenticated attackers can exploit this by tricking a user with upload files capabilities (Author level or higher) into clicking a crafted link to the '/wp-admin/media-upload' endpoint, allowing the execution of arbitrary web scripts.

Recommendations Update to a version newer than 1.20.2. Avoid using the keyword parameter in the '/wp-admin/media-upload' endpoint until the update is applied.