CVE-2026-81404: CWE-79 Cross-Site Scripting (XSS) in IPGP Visitors Origin

CVE-2026-81404 is a reflected Cross-Site Scripting (XSS) vulnerability in the IPGP Visitors Origin WordPress plugin before version 1.6. The plugin fails to sanitize or escape user-supplied input before reflecting it back in HTTP responses, enabling unauthenticated attackers to inject malicious scripts. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector. The vulnerability affects version 1.3 explicitly, with no confirmed patch or fix published as of now.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim user's browser when they submit a crafted request. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 7.1 reflects high severity with network attack vector, low attack complexity, no privileges required, but requires user interaction. The scope is changed, and the impact affects confidentiality, integrity, and availability at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to mitigate risk. Avoid clicking on suspicious links that may exploit this vulnerability.