CVE-2026-89249
The YPTWallet WordPress plugin contains a stored cross‑site scripting flaw that lets attackers inject malicious JavaScript into the wallet log. When an administrator views pending withdrawal requests, the injected code runs in their browser, enabling the attacker to perform privileged actions. The vulnerability is critical because it can be exploited remotely with minimal effort.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
YPTWallet plugin for WordPress (any version that includes the vulnerable commit c3edcc274c389816d434acadac07ee78eaf330c1).
Real-world impact
An attacker who injects malicious JavaScript can execute arbitrary code in the context of an administrator’s session, allowing them to approve or reject withdrawals, change settings, or exfiltrate data.
Why this severity
The CVSS score of 9.3 reflects that the flaw is exploitable over the network (AV:N), requires low attack complexity (AC:L), and gives the attacker low privileges (PR:L) but high impact on confidentiality, integrity, and availability. The lack of user interaction (UI:P) and the ability to execute code in an admin session make it a high‑risk vulnerability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources