CVE-2026-32571: WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs Subscriber-level access to a WordPress site using a vulnerable Ohio Extra version. Exploitation also requires user interaction.

Q: What impact can successful exploitation have?

The vulnerability is an XSS issue with low confidentiality, integrity, and availability impacts. Its scope is changed, meaning the effect can extend beyond the vulnerable component's authorization boundary.

Q: Which versions should be investigated?

Ohio Extra versions 3.6.8 and earlier are identified as affected. Check installed plugin versions across WordPress sites that use Colabrio Ohio Extra.

Published Oct 6, 2026

Updated

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

Affected Software

1 affected component

Colabrio Ohio Extra<=3.6.8

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs Subscriber-level access to a WordPress site using a vulnerable Ohio Extra version. Exploitation also requires user interaction.

What impact can successful exploitation have?

The vulnerability is an XSS issue with low confidentiality, integrity, and availability impacts. Its scope is changed, meaning the effect can extend beyond the vulnerable component's authorization boundary.

Which versions should be investigated?

Ohio Extra versions 3.6.8 and earlier are identified as affected. Check installed plugin versions across WordPress sites that use Colabrio Ohio Extra.

CVE-2026-32571: WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which versions should be investigated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact can successful exploitation have?

Which versions should be investigated?