CVE-2026-125854: WordPress Unbounce Landing Pages plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
Published Nov 13, 2026
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unbounce Unbounce Landing Pages unbounce allows Stored XSS.This issue affects Unbounce Landing Pages: from n/a through 1.1.6.
Affected Software
1 affected component
Unbounce Unbounce Landing Pages<=1.1.6
Event History
Nov 13, 2026
CVE Published
via MITRE·03:08 PM
Data Sourced
via MITRE·03:08 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated account?
No. The CVSS vector indicates no privileges are required for exploitation.
2
Does a victim need to interact with attacker-controlled content?
Yes. The CVSS vector indicates user interaction is required.
3
What is the potential impact if the vulnerability is exploited?
The reported CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed.