CVE-2026-17010 — Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level acc…
Published: 2026-08-10 · CVSS: 5.4 · CVSS 3.1
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7