CVE-2026-57651

Summary dbcve.org

A Cross Site Scripting (XSS) vulnerability exists in the Ghost Kit WordPress plugin (versions <= 3.6.0) that allows users with Contributor-level privileges to inject malicious scripts. The vulnerability stems from insufficient input sanitization or output encoding in the plugin, potentially allowing script execution when the crafted payload is rendered in the browser.

Mitigation

Update Ghost Kit to the latest version available from the vendor, which should contain proper input sanitization and output encoding to prevent XSS attacks. If no update is available, consider removing or disabling the plugin until a patch is released.