Vulnerabilities / ReactPress
ReactPress vulnerabilities
Advisories WPSec published for ReactPress – Create React App for WordPress. Other sources may list more. Its attack surface: ReactPress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-24 | WPSEC-2026-1622 | ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter | Medium 6.4 | 3.4.1 |
| 2026-10-24 | WPSEC-2026-1621 | ReactPress <= 3.4.0 - Authenticated (Subscriber+) Server-Side Request Forgery via 'permalink' Parameter | Medium 6.4 | 3.4.1 |
| 2026-10-24 | WPSEC-2026-1620 | ReactPress <= 3.4.0 - Missing Authorization to React App Deletion and Page Creation via repr_admin_ajax_request AJAX Action | Medium 5.4 | 3.4.1 |
License: CC BY 4.0