CVE-2026-0594 MEDIUM

CVE-2026-0594: List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha

Vendor Mallsop

Product List Site Contributors

Weakness CWE-79 · XSS

Published January 14, 2026

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The List Site Contributors plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'alpha' parameter in versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Key dates

02Disclosure timeline

January 14, 2026 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0594

Related vulnerabilities

04Related CVE

CVE-2024-7054 Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-7160 SourceCodester Engineers Online Portal Add Engineer cross site scripting CVE-2024-38675 WordPress Arkhe Blocks plugin 2.22.1 - Cross Site Scripting (XSS) vulnerability CVE-2025-6262 muse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode CVE-2024-37950 WordPress Master Popups plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability