Quick answers
- Is CVE-2026-78333 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78333 being exploited in the wild.
- How severe is CVE-2026-78333?
- High severity, with a CVSS score of 8.8, published 27 August 2026.
- Which products and versions are affected?
- 12 Step Meeting List 12 Step Meeting List 3.17 to 3.19.16.
- Is there a fix for CVE-2026-78333?
- A patch was published on 2026-08-27: Fixed in version 3.19.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78333 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-78333?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79) in the plugin's geocoding AJAX handler. The vulnerability exists because user-supplied data submitted to the tsml_geocode action via the address parameter is not properly sanitized or escaped before being stored in the activity log and later displayed in the WordPress admin area. The attack requires only a valid nonce (publicly available on any public meeting page) and no authentication; an attacker can craft a malicious address parameter containing JavaScript code (e.g., <img src=x onerror=alert(document.cookie)>) which persists in the database. When an administrator views the Event Log, the unescaped payload executes in their session, potentially allowing session hijacking or privilege escalation. The vulnerability was fixed in version 3.19.17.
Affected products
- 12 Step Meeting List 12 Step Meeting List 3.17 to 3.19.16
Timeline
- 2026-08-25: disclosed
- 2026-08-27: patched: Fixed in version 3.19.17