Vulnerability · Published Aug 10, 2026 · Assigned by WPScan
CVE-2026-17010Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta
Medium 5.4
In plain English
A medium-severity cross-site scripting in Saitama Addon Pack from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Saitama Addon Pack | 0 – through 1.0.8 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/1e760dbf-7efc-4511-9a05-2d1476eb3dfb/ exploit, vdb-entry, technical-description