Security Alert Summary
The StyleBidet WordPress plugin is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the URL path in all versions up to and including 1.0.0. Insufficient input sanitization and output escaping allow an unauthenticated attacker to inject script code that will be executed if a victim performs an action such as clicking a crafted link.
CVE Details
- CVE ID: CVE-2026-1796
- Affected component: StyleBidet plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.0
- Published: February 14, 2026 at 7:16:10 AM (UTC)
- Last modified: February 14, 2026 at 7:16:10 AM (UTC)
- CVSS v3.1: Base Score 6.1, Severity: MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Authentication / Privileges / User Interaction: Authentication not required; Privileges Required: None; User Interaction: Required
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a reflected Cross-Site Scripting (XSS) issue originating from insufficient input sanitization and missing output escaping of data taken from the URL path. Because the plugin echoes data from the request into pages without properly sanitizing or escaping it, an attacker can craft a URL containing script payloads that will be reflected back to and executed by a victim’s browser when the victim follows the link.
The vulnerability requires no authentication and relies on user interaction (for example, clicking a link). The description indicates the flaw is present in all versions through 1.0.0. The impact is the ability to execute arbitrary script in the context of the affected site for users who load the crafted URL; the CVE data does not list specific functions or REST endpoints by name.
How This Could Impact Your Website
Consider a small team running a WordPress site where the site owner publishes content, editors and contributors manage posts, and an external contractor occasionally performs updates or provides content. An attacker could send a crafted link to one of these users (for example, an editor or contributor). If that user clicks the link while logged into the site, the injected script could run in their browser and access any data available to their session, such as account cookies or information displayed on the page.
Practical consequences aligned with the reported impacts include disclosure of limited information accessible in the user’s session and the potential for altered page content or actions performed in the user’s browser context. This can increase the risk of targeted phishing or social engineering against staff or contractors who have higher privileges.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and editors with write access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and logs for unusual behavior, such as unexpected account actions or unfamiliar URLs being accessed by users.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
