CVE-2026-121763: WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

The attack vector indicates network access with low attack complexity, but the attacker must have low-level privileges in the affected WordPress environment. Exploitation also requires user interaction.

Q: How can I determine whether my site is affected?

A site is affected if it uses the WPMU DEV Hummingbird plugin at version 3.21.2 or earlier. The issue is listed as affecting versions through 3.21.2.

Q: What could successful exploitation allow?

This is a stored XSS issue. The supplied severity vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed.

Published Nov 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Hummingbird hummingbird-performance allows Stored XSS.This issue affects Hummingbird: from n/a through 3.21.2.

Affected Software

1 affected component

WPMU DEV Hummingbird<=3.21.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Hummingbird plugin to a version that resolves this vulnerability.
Fixed in 4.0.0

Event History

Nov 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack vector indicates network access with low attack complexity, but the attacker must have low-level privileges in the affected WordPress environment. Exploitation also requires user interaction.

How can I determine whether my site is affected?

A site is affected if it uses the WPMU DEV Hummingbird plugin at version 3.21.2 or earlier. The issue is listed as affecting versions through 3.21.2.

What could successful exploitation allow?

This is a stored XSS issue. The supplied severity vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed.

CVE-2026-121763: WordPress Hummingbird plugin <= 3.21.2 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

How can I determine whether my site is affected?

What could successful exploitation allow?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

How can I determine whether my site is affected?

What could successful exploitation allow?