CVE-2026-110525: MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

Q: Who is exposed to this issue?

Sites using the MCB WordPress plugin version 1.0.0 or earlier are exposed if an administrator views the plugin's statistics grid. An attacker does not need to authenticate to place the malicious payload.

Q: What does an attacker need to do to trigger the vulnerability?

The attacker needs to send a request containing a malicious value in a request header such as User-Agent. The payload executes only when an administrator later opens the statistics page that renders the stored header value.

Q: Is administrator interaction required for exploitation?

Yes. The malicious script is stored first, then runs in the browser session of an administrator when that administrator views the affected statistics grid.

Published Nov 6, 2026

Updated

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the MCB WordPress plugin version 1.0.0 or earlier are exposed if an administrator views the plugin's statistics grid. An attacker does not need to authenticate to place the malicious payload.

What does an attacker need to do to trigger the vulnerability?

The attacker needs to send a request containing a malicious value in a request header such as User-Agent. The payload executes only when an administrator later opens the statistics page that renders the stored header value.

Is administrator interaction required for exploitation?

Yes. The malicious script is stored first, then runs in the browser session of an administrator when that administrator views the affected statistics grid.

CVE-2026-110525: MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Is administrator interaction required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerability?

Is administrator interaction required for exploitation?