MCB vulnerabilities

CVEs whose affected-version data names the MCB package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110525High· 8.8

yesterday

MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript…

▾ TwilightEPSS 0.43%via CVEORG