CVE-2026-6858

Description

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

PUBLISHED Reserved 2026-04-22 | Published 2026-06-22 | Updated 2026-06-22 | Assigner WPScan

Problem types

CWE-79 Cross-Site Scripting (XSS)

Product status

Credits

Mateo Contenla & Matías Schiappacasse finder

WPScan coordinator

References

wpscan.com/...rability/81035d75-81a5-486a-a9fb-b0d1e0befe3c/ exploit vdb-entry technical-description

cve.org (CVE-2026-6858)

nvd.nist.gov (CVE-2026-6858)

Download JSON