[ CVE-2026-87777 · Published 30 Sep 2026 ]
Vulnerability in Unknown Hostinger Reach
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.