CVE-2026-113409 Details
Description
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.
A stored cross-site scripting vulnerability has been identified in the Ortto plugin for WordPress, affecting versions prior to 1.0.25. The issue arises because the plugin did not properly escape stored settings on its admin settings page. As a result, a threat actor with the ability to modify the plugin's configuration could execute arbitrary JavaScript in the context of an administrator's session when the impacted page is visited.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://trust.canva.com?tcuUid=acddc58b-886d-487c-b2d4-837fde87ddc8 | Canva | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Canva |
Affected Products
| Product | Versions |
|---|---|
| Ortto | < 1.0.25 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | Canva |