PULSE
ES
FEED
ransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Educationransomscarlettgroup reclama a nbcuniversal.com · US · Technologyransomn0n reclama a Xylanpicks · US · Not Foundransombravox reclama a GSE-M Technology Sdn. Bhd. · MY · Technologyransomemperador reclama a Bruin Group LLC · US · Otherransomsilentransomgroup reclama a M... M... · Not Foundransomsilentransomgroup reclama a P... H... · Not Foundransomglobal secret group reclama a Graves Fireplaces, Inc. · US · Manufacturingransomincransom reclama a centralrogers.com · US · Otherransomdark project reclama a Asensus Surgical · US · Healthcareransomdark project reclama a The Excalibur Group · US · Not Foundransomsilentransomgroup reclama a P...S...R... · Not Foundransomaurora reclama a Duarte Nursery, Inc. · US · Agriculture and Food Productionransomn0n reclama a 51Ridge (Newark NJ hosting/IT) · US · Technologyransombooba project reclama a Research Foundation of The City University of New York · US · Education
← All CVEs
CVE WatchSep 30, 2026

CVE-2026-87777

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview,

CVSS

—

No CVSS

EPSS

0.2%

p14

KEV

—

Exploit Today

4

0-100

Published: Sep 30, 2026 · Last modified: Sep 30, 2026

EPSS · 30d
0.2%EPSS · 30 days0.2%
2026-09-302026-10-20
Technical description

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.

Official references
Related CVEs

No related CVEs by CWE or product.