CVE-2026-19055: ProSolution WP Client < 2.0.11 - Reflected XSS via Multiple Parameters

Q: Who can be targeted by this issue?

Any visitor to affected public pages can be targeted, including a logged-in WordPress administrator.

Q: What does an attacker need to exploit it?

The attacker needs to cause a victim to visit a crafted request that supplies malicious values through one of the affected parameters. The vulnerable parameters are reflected into HTML attributes without sanitisation and escaping.

Q: Which plugin versions are affected?

ProSolution WP Client versions earlier than 2.0.11 are affected. Updating to version 2.0.11 or later addresses the stated affected version range.

Published Aug 19, 2026

Updated

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

Affected Software

1 affected component

WordPress plugin<2.0.11

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can be targeted by this issue?

Any visitor to affected public pages can be targeted, including a logged-in WordPress administrator.

What does an attacker need to exploit it?

The attacker needs to cause a victim to visit a crafted request that supplies malicious values through one of the affected parameters. The vulnerable parameters are reflected into HTML attributes without sanitisation and escaping.

Which plugin versions are affected?

ProSolution WP Client versions earlier than 2.0.11 are affected. Updating to version 2.0.11 or later addresses the stated affected version range.