CVE-2026-81776
Deferred Deferred - Pending Action

Unauthenticated XSS in WP QuickLaTeX

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: Patchstack

Description
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-81776
EUVD
EUVD-2026-70592

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_quicklatex wp_quicklatex to 3.8.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81776 is an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting WP QuickLaTeX plugin versions 3.8.8 and below. It allows attackers to inject malicious scripts into web pages, which execute when visitors access the site. Exploitation requires user interaction, such as clicking a malicious link.

Detection Guidance

Detecting this XSS vulnerability requires checking if the WP QuickLaTeX plugin version 3.8.8 or below is installed. Inspect your WordPress plugins directory for the plugin folder and check the version in the plugin's main file. No specific commands are provided, but manual verification of plugin versions is necessary.

Impact Analysis

This vulnerability can lead to malicious script execution on your website, including redirects, advertisements, or theft of user data. Attackers may exploit it to compromise visitor sessions or deface your site. User interaction is required, but mass campaigns could target many websites simultaneously.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Immediately disable or remove the WP QuickLaTeX plugin if unused. If the plugin is required, apply the mitigation rule provided by Patchstack to block attacks until an official patch is released. Contact your hosting provider or developer for assistance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart