PT-2026-34301 · WordPress · Ci Hub Connector

Djaidja Moundjid · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-4353

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CI HUB Connector versions prior to 1.2.107

Description The CI HUB Connector plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages. This occurs due to insufficient input sanitization and output escaping within the 'id' attribute of the cihub metadata shortcode. These scripts execute whenever a user visits the affected page.

Recommendations Update to a version later than 1.2.106.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4353

Affected Products

Ci Hub Connector

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4353 · Security Note
• https://plugins.trac.wordpress.org/browser/ci-hub-connector/trunk/ci-hub-wordpress-connector.php#L645 · Note
• https://plugins.trac.wordpress.org/browser/ci-hub-connector/tags/1.2.106/ci-hub-wordpress-connector.php#L645 · Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://twitter.com/VulmonFeeds/status/2046917469957173470 · Twitter Post
• https://twitter.com/infoflowcloud/status/2047013649537970644 · Twitter Post
• https://twitter.com/CVEnew/status/2047012172002386403 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f4b36468-319a-4de3-9112-bd4a3cf7d637?source=cve · Note