PT-2026-56327 · WordPress · Wp Js Detect

Swat · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-9731

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wp Js Detect versions prior to 1.1.0

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation within the plugin settings() function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to update the wp non js notification text and wp non js notification css variables. This enables the injection of arbitrary content that is displayed unescaped on the website frontend.

Recommendations Update Wp Js Detect to a version later than 1.0.9.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-9731

Affected Products

Wp Js Detect

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-9731 · Security Note
• https://t.me/cveNotify/190890 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-js-detect/trunk/wp-js-detect.php#L250 · Note
• https://t.me/cveNotify/191186 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-js-detect/trunk/wp-js-detect.php#L192 · Note
• https://plugins.trac.wordpress.org/browser/wp-js-detect/trunk/wp-js-detect.php#L190 · Note
• https://t.me/CVEtracker/59334 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wp-js-detect/trunk/wp-js-detect.php#L193 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/afca7b14-f3bb-4612-b81c-bde120b380ba?source=cve · Note