PT-2026-51278 · WordPress · Transbank Webpay

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-6858

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Transbank Webpay WordPress plugin versions prior to 1.14.0

Description The plugin fails to sanitize and escape logs before they are displayed. This allows unauthenticated users to execute Stored Cross-Site Scripting (XSS) attacks, which is a technique where malicious scripts are permanently stored on the target server, against logged-in administrators.

Recommendations Update to version 1.14.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6858

Affected Products

Transbank Webpay

References · 3

• 🔥 https://wpscan.com/vulnerability/81035d75-81a5-486a-a9fb-b0d1e0befe3c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6858 · Security Note
• https://twitter.com/VulmonFeeds/status/2068954189472911800 · Twitter Post