CVE-2026-100509: WordPress RepairBuddy plugin <= 4.1225 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs at least low-level privileges and must be able to induce a user to interact with the malicious content. The attack is network-accessible and does not require high attack complexity.

Q: What is the potential impact of successful exploitation?

Successful exploitation can result in stored cross-site scripting in the affected RepairBuddy plugin. The provided CVSS vector indicates limited impact to confidentiality, integrity, and availability, with scope changed.

Q: Which versions are affected?

RepairBuddy versions through 4.1225 are affected. The affected version range begins at an unspecified earlier version.

Published Oct 5, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.

Affected Software

1 affected component

Webful Creations RepairBuddy<=4.1225

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Webful Creations RepairBuddy WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.1227

Event History

Oct 5, 2026

CVE Published

via MITRE·06:08 PM

Data Sourced

via MITRE·06:08 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs at least low-level privileges and must be able to induce a user to interact with the malicious content. The attack is network-accessible and does not require high attack complexity.

What is the potential impact of successful exploitation?