Read the docs
TI-2026-75200 Aliases CVE-2026-89051GHSA-hvxm-vpq4-3qxh

Stored cross-site scripting in Hide My WP Ghost WordPress plugin

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Hide My WP Ghost Security & Firewall plugin for WordPress by johndarrel is affected in versions from 0 through 7.0.12. Insufficient input sanitization and output escaping in the replaceHeadersAndTags function (CWE-79) lets unauthenticated attackers store arbitrary web scripts in pages. The injected scripts run in a user's browser when that user clicks the injected link.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in versions up to, and including, 7.0.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected link.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0019 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
johndarrelHide My WP Ghost – Security & Firewallup to 7.0.12—No fix listedCNA
  • Hide My WP Ghost – Security & Firewall Vendorjohndarrel Affected up to 7.0.12 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Hide My WP Ghost Security & Firewall.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-89051
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Alias added: GHSA-hvxm-vpq4-3qxh

References

Other 2

  • TI-2024-05959 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure CVSS 3.1HIGH 8.6
  • TI-2025-19780 WordPress Hide My WP Ghost plugin <= 5.4.01 - Local File Inclusion to RCE vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2025-01794 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read CVSS 3.1HIGH 7.5
  • TI-2022-04143 Hide My WP Ghost – Security Plugin <= 5.0.18 - IP Address Spoofing to Protection Mechanism Bypass CVSS 3.1MEDIUM 6.5
  • TI-2023-16868 WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2023-15800 WordPress WP Chinese Conversion Plugin <= 1.1.16 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1HIGH 7.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences