What the vulnerability does
01Description
The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pro_version_activation_code' parameter in all versions up to, and including, 3.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Explanation of Vulnerability in Simple Terms
02Summary
Simple Banner versions 3.0.10 and earlier contain a cross-site scripting (XSS) vulnerability in banner content handling. An authenticated administrator with high privileges can inject malicious scripts that execute in the context of other users' browsers, potentially affecting site visitors. The vulnerability requires high attack complexity and does not require user interaction from the victim.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts into banners that execute in visitors' browsers, potentially stealing session data or performing actions on their behalf.
Potential impact on your site
04Site Impact
A compromised admin account could inject malicious code affecting all site visitors, potentially leading to credential theft or malware distribution.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrator privileges on the site and network access to the WordPress admin panel.
Key dates
06Disclosure timeline
October 22, 2025
CVE published
April 8, 2026
Record updated
