CVE-2026-2466
HIGHDukaPress WordPress Plugin <3.2.4 - XSS
Title source: llmDescription
The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
Scores
CVSS v3
7.1
EPSS
0.0003
EPSS Percentile
7.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Classification
CWE
CWE-79
Status
draft
Timeline
Published
Mar 11, 2026
Tracked Since
Mar 11, 2026