Description
The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.
Published: 2026-10-16
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting allowing authenticated users with contributor-level or higher to inject malicious scripts into pages
Action: Patch Immediately
AI Analysis

Impact

The WebberZone Top 10 plugin is vulnerable to Stored Cross‑Site Scripting (CWE‑79) because it concatenates an attacker‑controlled instance_id into an unescaped class attribute when a specific flag is set. An authenticated user with contributor or higher privileges can inject malicious JavaScript that will run whenever any visitor loads an affected page.

Affected Systems

The affected product is the WebberZone Top 10 — Popular Posts WordPress plugin, developed by ajay. Versions up to and including 4.5.2 contain the flaw. WordPress sites that have this plugin installed with contributor or higher roles are at risk.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. The EPSS score is less than 1%, showing a low likelihood of exploitation. The flaw requires the attacker to be authenticated with contributor or higher privileges. Once the vulnerable block is inserted, the stored script is served to any user who views the page. The flaw is not listed in the CISA KEV catalogue.

Generated by OpenCVE AI on October 16, 2026 at 14:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WebberZone Top 10 plugin to version 4.5.3 or newer.
  • If the plugin cannot be updated immediately, restrict contributor and lower role capabilities to prevent use of the block JSON with the 'is_widget' flag.
  • Disable or remove the block that triggers the vulnerability from front‑end pages until the patch is applied.

Generated by OpenCVE AI on October 16, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id) + undeclared is_widget' parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to '1' via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.
Title WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T14:39:03.035Z

Reserved: 2026-10-13T19:46:30.885Z

Link: CVE-2026-110290

cve-icon Vulnrichment

Updated: 2026-10-16T14:34:07.303Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T07:17:11.183

Modified: 2026-10-16T15:17:10.957

Link: CVE-2026-110290

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T14:45:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')