PT-2026-20641 · WordPress · Xmlrpc Attacks Blocker

Nabil Irawan · Published 2026-02-19 · Updated 2026-02-23 · CVE-2026-2502

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions xmlrpc attacks blocker plugin for WordPress versions prior to 1.1

Description The xmlrpc attacks blocker plugin for WordPress is susceptible to Stored Cross-Site Scripting. This occurs due to the plugin trusting and logging attacker-controlled data from the X-Forwarded-For HTTP header, and then rendering debug log entries without proper output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the debug log page.

Recommendations Update the xmlrpc attacks blocker plugin to version 1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-2502

Affected Products

Xmlrpc Attacks Blocker

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2502 · Security Note
• https://twitter.com/CVEnew/status/2025892082171126151 · Twitter Post
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L341 · Note
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L269 · Note
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L186 · Note
• https://plugins.trac.wordpress.org/browser/xmlrpc-attacks-blocker/tags/1.0/plugin.php#L312 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/059f0c64-efcc-4b79-81eb-b4ae9e3e2826?source=cve · Note