CVE-2026-89051

{
  "etk_id": "ETK-2026-1920",
  "cve_id": "CVE-2026-89051",
  "display_id": "CVE-2026-89051",
  "ghsa_id": "GHSA-hvxm-vpq4-3qxh",
  "euvd_id": "EUVD-2026-102674",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Hide My WP Ghost",
  "summary": "Hide My WP Ghost for WordPress is affected through version 7.0.12. An unauthenticated attacker may cause script content to be stored in site pages, where it can run when a visitor follows a malicious link.",
  "mitigation": "Disable the plugin where it is not required, or limit public access to affected pages until vendor guidance is available. Review site pages for unexpected links or injected content and remove any found.",
  "vendor": "johndarrel",
  "product": "Hide My WP Ghost – Security & Firewall",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 7.0.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Hide My WP Ghost – Security & Firewall",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "epss_score": 0.0019,
  "epss_percentile": 0.0818,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.010578716666666666,
  "t0_at": "2026-10-16T05:30:25.377000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-18T02:02:25.116116+00:00",
      "days": 1.8555525360648149,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:25.377000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T05:30:25.377000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:25.377000+00:00",
      "url": "https://github.com/advisories/GHSA-hvxm-vpq4-3qxh"
    }
  }
}