CVE-2026-81742
Received Received - Intake

Unauthenticated Stored XSS in BE REST Endpoints WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: WPScan

Description
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-81742
EUVD
EUVD-2026-76786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
be_rest_endpoints plugin to 1.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated stored cross-site scripting (XSS) flaw in the BE REST Endpoints WordPress plugin version 1.0.0 or below. It allows attackers to inject malicious scripts into widgets without authentication. These scripts execute in the browsers of site visitors when they access the compromised pages.

Detection Guidance

Check for unauthorized widget modifications in WordPress admin panels or inspect network traffic for suspicious POST requests to /wp-json/be-rest-endpoints/v1/widgets. Look for unexpected script tags in widget content or unusual widget creation/deletion logs.

Impact Analysis

Unauthenticated users can read, create, update, and delete widgets. They can inject harmful scripts that steal user data, hijack sessions, or deface the website. Visitors' browsers may execute these scripts, leading to potential account takeovers or malware infections.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Stored XSS may expose sensitive information, resulting in non-compliance, legal penalties, and reputational damage for organizations handling personal or health data.

Mitigation Strategies

Disable the BE REST Endpoints plugin immediately if installed. Monitor for unauthorized widget changes and remove any suspicious scripts. Apply WordPress hardening measures like disabling file editing and limiting user roles.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart