CVE-2026-6858 — Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logge…
Published: 2026-06-22 · CVSS: 7.1 · CVSS 3.1
The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7