PULSE
LIVE91signals / 24h
ES
FEED
ransomshinyhunters reclama a RingCentral, Inc. · US · Technologyransomshinyhunters reclama a Ernst & Young · US · Professional Servicesransomqilin reclama a Savills France · FR · Professional Servicesransomqilin reclama a Wilbert's · US · Retail & E-Commerceransomdragonforce reclama a Katathani Phuket Beach Resort · TH · Hospitalityransomcrpxo reclama a IPTV Platform · US · Technology · 3.2 GBransomcrpxo reclama a Marketech · US · Technology · 6.7 GBransomcrpxo reclama a American Hospice & Home Health Services (Ahhh Care) · US · Healthcare · 11.3 GBransomcrpxo reclama a Bright Star Partners Insurance · US · Financial Services · 41.8 GBransomcrpxo reclama a eCare Platform · US · Healthcare · 14.2 GBransomcrpxo reclama a Dignity Phoenix · US · Healthcare · 5.4 GBransomcrpxo reclama a Schorr Law · US · Professional Services · 27.6 GBransomcrpxo reclama a Simpkins Law Firm · US · Professional Services · 31.2 GBransomcrpxo reclama a Leah Walker Orthodontics · US · Healthcare · 8.3 GBransomshinyhunters reclama a RingCentral, Inc. · US · Technologyransomshinyhunters reclama a Ernst & Young · US · Professional Servicesransomqilin reclama a Savills France · FR · Professional Servicesransomqilin reclama a Wilbert's · US · Retail & E-Commerceransomdragonforce reclama a Katathani Phuket Beach Resort · TH · Hospitalityransomcrpxo reclama a IPTV Platform · US · Technology · 3.2 GBransomcrpxo reclama a Marketech · US · Technology · 6.7 GBransomcrpxo reclama a American Hospice & Home Health Services (Ahhh Care) · US · Healthcare · 11.3 GBransomcrpxo reclama a Bright Star Partners Insurance · US · Financial Services · 41.8 GBransomcrpxo reclama a eCare Platform · US · Healthcare · 14.2 GBransomcrpxo reclama a Dignity Phoenix · US · Healthcare · 5.4 GBransomcrpxo reclama a Schorr Law · US · Professional Services · 27.6 GBransomcrpxo reclama a Simpkins Law Firm · US · Professional Services · 31.2 GBransomcrpxo reclama a Leah Walker Orthodontics · US · Healthcare · 8.3 GB
← All CVEs
CVE WatchJul 27, 2026

CVE-2026-13726

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthen

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Jul 27, 2026 · Last modified: Jul 27, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

Official references
Related CVEs

No related CVEs by CWE or product.