CVE-2026-105870: WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WP Associate Post R2to a version that resolves this vulnerability.Fixed in 5.0.2
Event History
Frequently Asked Questions
Which installations should be treated as affected?
WP Associate Post R2 installations running version 5.0.1 or an earlier affected version should be treated as vulnerable. The affected version range is listed as through 5.0.1.
What does an attacker need to exploit this issue?
The vulnerability is remotely reachable, has low attack complexity, and does not require attacker privileges. User interaction is required, consistent with an attacker needing to cause a user to interact with a crafted request or page.
What is the likely impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the impact may extend beyond the vulnerable component's original security authority.