CVE-2026-125045mediumCWE-79

CVE-2026-125045: medium-severity vulnerability in John-Michael L'Allier Create

WordPress Create plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Published

Follow this CVE+ Monitor Create

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected products
John-Michael L'Allier · Create
Related CVEs — John-Michael L'Allier Create

In the same product, most dangerous first.

CVE-2026-24552HIGHWordPress Create by Mediavine plugin <= 2.5.3 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-65490MEDIUMWordPress Create by Mediavine plugin <= 2.6.0 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-125046MEDIUMWordPress Create plugin <= 3.1.1 - Broken Access Control vulnerabilityEPSS —