# WPComplete <= 2.9.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Name

- **ID:** WPSEC-2026-0609
- **Plugin:** WPComplete (`wpcomplete`), https://wordpress.org/plugins/wpcomplete/
- **Affected versions:** from 2.3 before 2.9.5.8
- **Fixed in:** 2.9.5.8 (Update to 2.9.5.8 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpcomplete
- **Fix released:** 2026-10-07
- **Published:** 2026-10-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0609/

## Description

The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via course names in versions 2.3 up to, and including, 2.9.5.7. The cause is insufficient input sanitization and output escaping: a course name submitted through the post metabox or the posts-list 'Assign to' bulk action is decoded again whenever it is read back and printed without escaping in the quick-edit course dropdown, the posts-list course column, the bulk-action inline script, the dashboard widget and the course and user completion reports. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when an administrator views the affected admin pages.

## References

- https://wpsec.com/vuln/WPSEC-2026-0609/
- https://plugins.svn.wordpress.org/wpcomplete/tags/2.9.5.8/
- https://wordpress.org/plugins/wpcomplete/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0609/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.