Executive brief
The rognone plugin for WordPress is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. This occurs when a user clicks a specially crafted link provided by an attacker. If successful, this could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
The rognone plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability within the 'mode' parameter of the header.php file. The root cause is insufficient input sanitization and output escaping of user-supplied data. An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link, allowing the execution of arbitrary web scripts in the context of the victim's browser session. This can lead to session hijacking or unauthorized administrative actions if the victim is an authenticated administrator. The vulnerability is present in all versions up to and including 0.6.2.
Affected products
- WordPress Plugin rognone up to, and including, 0.6.2
Timeline
- 2026-06-02: disclosed: Vulnerability published to NVD and Wordfence database.