The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against user…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.2%

3. Sep 8, 2026Record revised

   Last analysed / modified upstream

4. Sep 8, 2026CVSS changed

   7.1 → —

5. Sep 8, 2026Severity changed

   high → none

6. Sep 9, 2026CVSS changed

   — → 7.1

7. Sep 9, 2026Severity changed

   none → high

8. Sep 9, 2026CVSS changed

   7.1 → —

9. Sep 9, 2026Severity changed

   high → none

10. Sep 9, 2026CVSS changed

    — → 7.1

11. Sep 9, 2026Severity changed

    none → high

12. Sep 9, 2026CVSS changed

    7.1 → —

13. Sep 9, 2026Severity changed

    high → none

14. Sep 9, 2026CVSS changed

    — → 7.1

15. Sep 9, 2026Severity changed

    none → high

16. Sep 25, 2026EPSS peak

    0.2% → 0.3%

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 7.1
• Sep 9, 2026Severity none → high
• Sep 9, 2026CVSS 7.1 → —
• Sep 9, 2026Severity high → none
• Sep 9, 2026CVSS — → 7.1
• Sep 9, 2026Severity none → high
• Sep 9, 2026CVSS 7.1 → —
• Sep 9, 2026Severity high → none
• Sep 9, 2026CVSS — → 7.1
• Sep 9, 2026Severity none → high
• Sep 8, 2026CVSS 7.1 → —
• Sep 8, 2026Severity high → none