PT-2026-42083 · WordPress · Sponsorme

Abdulsamad Yusuf · Published 2026-05-20 · Updated 2026-05-28 · CVE-2026-8626

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SponsorMe versions prior to 0.5.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages. This occurs when a user is tricked into clicking a crafted link. The PHP SELF variable is reflected in a form action attribute and an anchor href attribute within the vulnerable function, which can be exploited by appending a payload to the 'wp-admin/admin.php' endpoint.

Recommendations Update to a version later than 0.5.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-8626

Affected Products

Sponsorme

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-8626 · Security Note
• https://plugins.trac.wordpress.org/browser/sponsorme/trunk/sponsorme.php#L475 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7df7f541-b8aa-46fa-bfca-b333beea27f9?source=cve · Note
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://plugins.trac.wordpress.org/browser/sponsorme/trunk/sponsorme.php#L440 · Note
• https://t.me/CVEtracker/54331 · Telegram Post