Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-113409

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the pl

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Canva

Description

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

canva ortto

Default version status: unaffected

  • 0 to < 1.0.25affected

References