Executive brief
The rognone plugin for WordPress is vulnerable to a security flaw that allows attackers to run malicious scripts in a user's browser. This occurs when a user clicks on a specially crafted link provided by an attacker. If successful, this could allow unauthorized actions to be performed on behalf of the user or lead to the theft of sensitive session information.
Technical details
The rognone plugin for WordPress (versions up to 0.6.2) contains a reflected cross-site scripting (XSS) vulnerability within the 'header.php' file. The flaw stems from insufficient sanitization and output escaping of the 'a' parameter. An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link, leading to the execution of arbitrary JavaScript in the context of the victim's browser session. This can be used to hijack sessions or perform unauthorized actions on the WordPress site.
Affected products
- rognone rognone up to, and including, 0.6.2
Timeline
- 2026-06-02: disclosed: Initial disclosure by Wordfence and NVD publication.