CVE-2026-125433: WordPress Futurio Extra plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. It is remotely reachable over the network and has low attack complexity.

Q: What is the impact if exploitation succeeds?

The vulnerability allows stored cross-site scripting, meaning attacker-supplied script can be saved and later executed when another user views affected content. The listed impacts include low confidentiality, integrity, and availability effects, with scope changed.

Q: Which versions are affected?

Futurio Extra versions through 2.0.25 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade futurio-extra to a version that resolves this vulnerability.
Fixed in 2.0.26

Event History

Nov 11, 2026

CVE Published

via MITRE·12:39 PM

Data Sourced

via MITRE·12:39 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and user interaction to exploit the vulnerability. It is remotely reachable over the network and has low attack complexity.

What is the impact if exploitation succeeds?

The vulnerability allows stored cross-site scripting, meaning attacker-supplied script can be saved and later executed when another user views affected content. The listed impacts include low confidentiality, integrity, and availability effects, with scope changed.

Which versions are affected?

Futurio Extra versions through 2.0.25 are affected. The available data does not identify a fixed version.

CVE-2026-125433: WordPress Futurio Extra plugin <= 2.0.25 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which versions are affected?