CVE-2026-125045: WordPress Create plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Q: What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-privilege access and that a user must interact with the injected content. The attack can be performed remotely and has low attack complexity.

Q: Does exploitation affect only the user who views the payload?

No. The CVSS vector indicates scope is changed, meaning the vulnerable component and the impacted security authority differ. Confidentiality, integrity, and availability impacts are each rated low.

Q: Which plugin versions are affected?

Create versions through 3.1.1 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Create plugin to a version that resolves this vulnerability.
Fixed in 3.1.2

Event History

Nov 11, 2026

CVE Published

via MITRE·12:34 PM

Data Sourced

via MITRE·12:34 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and interaction are required to exploit this issue?

The CVSS vector indicates that an attacker needs low-privilege access and that a user must interact with the injected content. The attack can be performed remotely and has low attack complexity.

Does exploitation affect only the user who views the payload?

No. The CVSS vector indicates scope is changed, meaning the vulnerable component and the impacted security authority differ. Confidentiality, integrity, and availability impacts are each rated low.

Which plugin versions are affected?

Create versions through 3.1.1 are affected. The available data does not identify a fixed version.

CVE-2026-125045: WordPress Create plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Does exploitation affect only the user who views the payload?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What access and interaction are required to exploit this issue?

Does exploitation affect only the user who views the payload?

Which plugin versions are affected?