{
 "id": "WPSEC-2026-1175",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1175/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1175/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1175/index.md",
 "title": "Read More Without Refresh < 4.3.1 - Reflected Cross-Site Scripting via Pricing Page Query Parameters",
 "description": "The Read More Without Refresh plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via query parameters of the pricing page in its bundled Freemius SDK in versions 4.1.0 up to, but not including, 4.3.1. This is due to the raw $_GET array being merged over the server-built pricing configuration, so request values such as contact_url replace the trusted values passed to the pricing JavaScript application. That application renders contact_url as a link href without checking the URL scheme. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run in an administrator's browser session if they can trick the administrator into opening a crafted link and clicking the injected link on the pricing page.",
 "plugin": {
  "slug": "read-more-without-refresh",
  "name": "Read More Without Refresh",
  "full_name": "Read More Without Refresh",
  "wordpress_org": "https://wordpress.org/plugins/read-more-without-refresh/",
  "advisories_url": "https://wpsec.com/vuln/plugin/read-more-without-refresh/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/read-more-without-refresh"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1.0",
    "from_inclusive": true,
    "to": "4.3.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1.0 before 4.3.1"
  ]
 },
 "introduced_in": "4.1.0",
 "fixed_in": "4.3.1",
 "remediation": "Update to 4.3.1 or later.",
 "fix_released": "2026-10-16T06:26:46+00:00",
 "published": "2026-10-17T09:45:54+00:00",
 "updated": "2026-10-17T09:24:51.207446+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1175/",
  "https://plugins.svn.wordpress.org/read-more-without-refresh/tags/4.3.1/",
  "https://wordpress.org/plugins/read-more-without-refresh/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/read-more-without-refresh",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}