CVE-2026-19056
Received Received - Intake

Reflected Cross-Site Scripting in ProSolution WP Client WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: WPScan

Description
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-19056
EUVD
EUVD-2026-62287

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prosolution wp_client to 2.0.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ProSolution WP Client WordPress plugin before version 2.0.11 has a reflected Cross-Site Scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape a parameter before reflecting it into an HTML attribute on an administrative page. An attacker can exploit this by tricking an administrator into submitting a crafted request, which then executes malicious scripts in the administrator's session.

Detection Guidance

Check the installed version of the ProSolution WP Client plugin. If it is below 2.0.11, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep wp_client in WP-CLI.

Impact Analysis

This vulnerability allows attackers to inject malicious scripts into your WordPress admin pages. If you are an administrator, clicking a malicious link could execute these scripts in your browser session, potentially leading to unauthorized actions, data theft, or further compromise of your WordPress site.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR or HIPAA compliance requirements. If exploited, it could result in data breaches, unauthorized data exposure, or loss of control over user data, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Update the ProSolution WP Client plugin to version 2.0.11 or later immediately. Disable the plugin temporarily if an update is not immediately available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart