CVE-2026-113409: XSS
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ortto plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.0.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to modify the Ortto plugin's configuration. Exploitation also requires an administrator to visit the plugin's affected admin settings page.
Which versions are affected?
Ortto plugin for WordPress versions before 1.0.25 are affected.
What is the impact if exploitation succeeds?
The attacker can execute arbitrary JavaScript in the visiting administrator's session. The reported impact includes low confidentiality and integrity impact, with no availability impact.