CVE-2026-8707 MEDIUM

CVE-2026-8707: NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF

Vendor Nsthemes

Product NS Product icon badge

Weakness CWE-79 · XSS

Published May 27, 2026

Last update May 27, 2026

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

Description

The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Key dates

Disclosure timeline

May 27, 2026 CVE published

May 27, 2026 Record updated