CVE-2026-96819: WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.
Affected Software
1 affected component
WordPress oik plugin<=4.15.4
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress oik Pluginto a version that resolves this vulnerability.Fixed in 4.16.0
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which sites are in scope for this issue?
WordPress sites running the oik plugin at version 4.15.4 or earlier are in scope based on the affected-version information provided.
2
What access does an attacker need?
The issue is identified as subscriber-level XSS, indicating exploitation involves a WordPress subscriber account. The vector also indicates no privileges beyond that level are required.
3
Does exploitation require someone to interact with malicious content?
Yes. The CVSS vector includes UI:R, meaning user interaction is required for exploitation.