Executive brief
Kalles Addons is a popular WordPress plugin that extends site functionality with additional features. A cross-site scripting (XSS) vulnerability allows a subscriber-level user to inject malicious scripts that could steal visitor data or hijack accounts. While the vulnerability requires a privileged user action (like clicking a link), it poses a moderate risk to website security and visitor safety.
Technical details
A stored/reflected cross-site scripting (XSS) vulnerability exists in Kalles Addons plugin versions up to 1.0.6, classified as OWASP A3: Injection. The vulnerability requires a subscriber-level user to craft and deliver a malicious payload (e.g., via a link or form submission) that executes in the context of other users' browsers. Attackers can steal session tokens, redirect visitors, or perform actions on behalf of users. The attack vector is network-based and requires user interaction. No official patch is available; mitigation via WAF rules or plugin updates is recommended as a workaround.
Affected products
- Kalles Addons up to 1.0.6
Timeline
- 2026-08-31: disclosed: Published by Patchstack