CVE-2026-81754: Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload is delivered passively by any unauthenticated visitor who triggers a failed login attempt with a crafted User-Agent header, requiring no further interaction from the attacker once stored.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin "Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…"to a version that resolves this vulnerability.Fixed in 2.10.2
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can attempt exploitation. They only need to submit a failed login attempt with a crafted User-Agent header; no account or subsequent interaction is required from the attacker after the payload is stored.
Which installations are affected?
All Vigilant plugin versions through 2.10.2, including 2.10.2, are affected. The issue is in the WordPress plugin.
When does the injected script execute?
The script executes when a user accesses a page containing the stored injected content. The vulnerability is stored XSS, so the attacker can deliver the payload passively through the crafted header during a failed login attempt.