UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-120688

EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header

Severity
High 7.2
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Weakness
Cross-site scripting (CWE-79)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Sources
CVE Program

Description

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation.

From the CVE Program.

Affected software

SoftwareAffected versions
Elisqlreports (WordPress plugin)WordPress plugins · wp-plugin:elisqlreports
  • Every version up to 5.25.25

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-120688