{
 "id": "WPSEC-2026-1174",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1174/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1174/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1174/index.md",
 "title": "Read More Without Refresh < 4.3.1 - Unauthenticated Content Injection via Freemius SDK 'purchase_completed' Admin Notice",
 "description": "The Read More Without Refresh plugin for WordPress is vulnerable to Content Injection via the 'purchased_plan' and 'purchase_email' parameters handled by its bundled Freemius SDK in versions 4.1.0 up to, but not including, 4.3.1. This is due to the SDK saving a persistent 'plan_purchased' admin notice built from these request parameters whenever a wp-admin URL carrying 'purchase_completed' is loaded, during plugin initialisation and before any authentication, capability or nonce check. This makes it possible for unauthenticated attackers to inject arbitrary text into a sticky notice shown to administrators in the dashboard, for example misleading purchase or license messages used for phishing, on sites that have opted in to Freemius. HTML is stripped, so script injection is not possible.",
 "plugin": {
  "slug": "read-more-without-refresh",
  "name": "Read More Without Refresh",
  "full_name": "Read More Without Refresh",
  "wordpress_org": "https://wordpress.org/plugins/read-more-without-refresh/",
  "advisories_url": "https://wpsec.com/vuln/plugin/read-more-without-refresh/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/read-more-without-refresh"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1.0",
    "from_inclusive": true,
    "to": "4.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1.0 before 4.3.1"
  ]
 },
 "introduced_in": "4.1.0",
 "fixed_in": "4.3.1",
 "remediation": "Update to 4.3.1 or later.",
 "fix_released": "2026-10-16T06:26:46+00:00",
 "published": "2026-10-17T09:45:54+00:00",
 "updated": "2026-10-17T09:24:51.207446+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1174/",
  "https://plugins.svn.wordpress.org/read-more-without-refresh/tags/4.3.1/",
  "https://wordpress.org/plugins/read-more-without-refresh/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/read-more-without-refresh",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}