PT-2026-20763 · Pencidesign · Penci Filter Everything

João Pedro S Alcântara + 1 · Published 2026-02-19 · Updated 2026-02-19 · CVE-2026-27057

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PenciDesign Penci Filter Everything versions through 1.7

Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting (XSS) issue. This allows for the injection of malicious scripts into web pages viewed by other users. The issue is identified as Stored XSS, meaning the malicious script is permanently stored on the target server.

Recommendations Update Penci Filter Everything to a version newer than 1.7.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27057

Affected Products

Penci Filter Everything

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-27057 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/penci-filter-everything/vulnerability/wordpress-penci-filter-everything-plugin-1-7-cross-site-scripting-xss-vulnerability-2?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2024411329260310739 · Twitter Post