CVE-2026-92967 Details
Description
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $_GET['keyword'], applies only sanitize_text_field() (which strips tags but leaves double quotes intact) and interpolates the value directly into the value attribute of the search input via a PHP heredoc, without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user with upload_files capability (Author or above) into performing an action such as clicking on a specially crafted link to /wp-admin/media-upload.
A reflected cross-site scripting vulnerability has been identified in the Pochipp plugin for WordPress, affecting versions through 1.20.2. The issue arises from inadequate output escaping of the 'keyword' parameter, which is processed by sanitize_text_field()—a function that removes tags but leaves double quotes—before being directly inserted into the value attribute of a search input using a PHP heredoc. This vulnerability allows unauthenticated attackers to inject arbitrary scripts into pages, where they could be executed if a user with the 'upload_files' capability (such as an Author) is tricked into clicking a specially crafted link to the media upload section.
Users are advised to update the Pochipp WordPress plugin to version 1.20.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 19, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://plugins.trac.wordpress.org/browser/pochipp/tags/1.20.2/inc/thickbox.php#L10 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/pochipp/tags/1.20.2/inc/thickbox.php#L20 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/pochipp/tags/1.20.2/inc/thickbox/serach_items.php#L13 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/browser/pochipp/tags/1.20.2/inc/thickbox/serach_items.php#L19 | [email protected] | Broken LinkSource CodeVendor |
| https://plugins.trac.wordpress.org/changeset?reponame=&old=3701315%40pochipp&new=3701315%40pochipp | [email protected] | Source CodeVendor |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/eb138c9c-49c2-4534-bb37-ca163d035f46?source=cve | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pochipp | <= 1.20.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 19, 2026 | New CVE Received | [email protected] |