Executive brief
Breakdance is a popular website builder plugin for WordPress. A security flaw allows unauthenticated attackers to inject malicious scripts into the website, which could lead to unauthorized redirects, theft of user session data, or the display of fraudulent content to visitors. This occurs when a site administrator or visitor interacts with a specially crafted link or page.
Technical details
The Breakdance plugin for WordPress (versions <= 2.7.1) is vulnerable to Unauthenticated Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation (CWE-79). An attacker can exploit this by sending a crafted request to a vulnerable site, which requires a victim (such as an administrator) to perform an action like clicking a malicious link. Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser session, potentially leading to session hijacking or site defacement. The issue is resolved in version 2.7.2.
Affected products
- Soflyy Breakdance <= 2.7.1
Timeline
- 2026-05-05: other: Reported by researcher dutafi
- 2026-07-10: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD dataset