CVE-2026-78333: CWE-79 Cross-Site Scripting (XSS) in 12 Step Meeting List
Description
The 12 Step Meeting List WordPress plugin before version 3.19.17 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape input submitted by unauthenticated users before storing it in its activity log and displaying it in the admin area. This vulnerability could allow attackers to execute malicious scripts in the context of high privilege users such as administrators.
CVSS v3.1
Score 8.8high
Affected software
12 Step Meeting List
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-78333 is a stored Cross-Site Scripting (CWE-79) vulnerability in the 12 Step Meeting List WordPress plugin. Versions prior to 3.19.17 fail to sanitize and escape user-submitted values before storing them in the activity log and rendering them in the admin interface. Because the input can be submitted by unauthenticated users, this flaw could be exploited to execute arbitrary scripts in the browser of admin users viewing the activity log, potentially leading to full compromise of the admin session or site.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of high privilege users such as administrators. This can lead to theft of credentials, session hijacking, or other administrative actions performed by the victim user. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.
Mitigation Recommendations
No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the activity log page to trusted users only and consider disabling the plugin or limiting unauthenticated user input if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-24T09:54:25.627Z
- State
- PUBLISHED
Threat ID: 6a8fd7c3acd9273b49e17820
Added to database: 08/27/2026, 06:22:59 UTC
Last enriched: 09/09/2026, 12:52:32 UTC
Last updated: 10/11/2026, 06:48:18 UTC
Views: 96
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.