---
id: CVE-2026-110525
title: MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent
summary: >-
  The MCB  WordPress plugin through 1.0.0 does not sanitise or escape request
  header values before storing them and later rendering them in the
  administrator statistics grid, allowing unauthenticated attackers to store
  malicious JavaScript…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: MCB
affected:
  - MCB <= 1.0.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:49:39.215033Z'
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:02:21.806Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110525'
references:
  - url: 'https://wpscan.com/vulnerability/4be75329-7348-4e4a-a541-6c53256d92eb/'
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.284Z'
epss: 0.00432
epssPercentile: 0.37636
---

## Overview

The MCB  WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.

## Affected

- `MCB <= 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.