CVE-2026-113409
Received Received - Intake

Stored XSS in Ortto WordPress Plugin

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: Canva

Description
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-113409
EUVD
EUVD-2026-112571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canva ortto 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Ortto WordPress plugin before version 1.0.25 had a stored cross-site scripting (XSS) vulnerability. It failed to properly escape stored settings on its admin settings page, allowing attackers with configuration access to inject malicious JavaScript. This script would execute when an administrator visited the affected page.

Detection Guidance

Check if the Ortto plugin for WordPress is installed and verify its version. If it is below 1.0.25, the vulnerability may be present. Inspect the plugin's admin settings page for unescaped stored settings that could allow JavaScript injection.

Impact Analysis

An attacker could exploit this to run arbitrary JavaScript in an admin's browser session. This could lead to session hijacking, unauthorized actions, or theft of sensitive data like credentials. Administrators visiting the plugin's settings page would be affected.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to personal data, leading to potential breaches of GDPR or HIPAA. It undermines data protection measures and may require reporting under these regulations.

Mitigation Strategies

Update the Ortto plugin to version 1.0.25 or later immediately. Review the plugin's configuration settings to ensure no malicious JavaScript has been injected. Remove any unauthorized changes to the plugin's settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart