PT-2026-31842 · WordPress · Webling

Kate Kligman · Published 2026-04-10 · Updated 2026-04-11 · CVE-2026-1263

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webling plugin for WordPress versions prior to 3.9.1

Description The Webling plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the webling admin save form and webling admin save memberlist functions. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts into Webling forms and memberlists. These scripts will execute when an administrator views the corresponding form or memberlist area within the WordPress admin interface.

Recommendations Update the Webling plugin to version 3.9.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1263

Affected Products

Webling

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1263 · Security Note
• https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Memberlist_List.php#L115 · Note
• https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/lists/Form_List.php#L122 · Note
• https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_memberlist.php#L2 · Note
• https://twitter.com/CVEnew/status/2042561800731005305 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bd8fbe0d-0709-4fa2-9294-393ddcd05b22?source=cve · Note
• https://plugins.trac.wordpress.org/browser/webling/tags/3.9.0/src/admin/actions/save_form.php#L2 · Note
• https://twitter.com/CVEarity/status/2042856744456720614 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fwebling/tags/3.9.0&new_path=%2Fwebling/tags/3.9.1 · Note