What is GHSA-hp42-vhhj-w836?

GHSA-hp42-vhhj-w836 is a security advisory published by GitHub Security Advisories with High severity. The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before...

Which CVE IDs does GHSA-hp42-vhhj-w836 cover?

GHSA-hp42-vhhj-w836 covers the following CVE IDs: CVE-2026-110525. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hp42-vhhj-w836?

GHSA-hp42-vhhj-w836 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-hp42-vhhj-w836HighCVSS 8.8

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-110525 →

📋 Description

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110525
https://wpscan.com/vulnerability/4be75329-7348-4e4a-a541-6c53256d92eb
https://github.com/advisories/GHSA-hp42-vhhj-w836