{
 "id": "WPSEC-2026-2131",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2131/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2131/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2131/index.md",
 "title": "Hide My WP Ghost <= 7.0.15 - Unauthenticated Stored Cross-Site Scripting via Link Rewriting",
 "description": "The Hide My WP Ghost plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its output link-rewriting feature in all versions up to, and including, 7.0.15. When the 'hmwp_fix_relative' option is enabled, the link-rewriting regex callback (replaceLinks/_rel2abs in models/Rewrite.php) could capture a value that ran past an HTML tag boundary, and escaped '..\\/' relative paths were not recognized, so attacker-influenced page content containing angle brackets was rewritten back into the page HTML. This makes it possible for unauthenticated attackers who can place content on the site, such as comments, to break the page markup and inject arbitrary web scripts that execute whenever a user accesses an affected page, provided the plugin's relative-link rewriting is active.",
 "plugin": {
  "slug": "hide-my-wp",
  "name": "Hide My WP Ghost",
  "full_name": "Hide My WP Ghost – Security & Firewall",
  "wordpress_org": "https://wordpress.org/plugins/hide-my-wp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/hide-my-wp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/hide-my-wp"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.0.16",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.0.16"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.0.16",
 "remediation": "Update to 7.0.16 or later.",
 "fix_released": "2026-10-29T18:28:25+00:00",
 "published": "2026-10-30T18:41:28+00:00",
 "updated": "2026-10-30T09:25:15.328626+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2131/",
  "https://plugins.svn.wordpress.org/hide-my-wp/tags/7.0.16/",
  "https://wordpress.org/plugins/hide-my-wp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/hide-my-wp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}