Hostinger Reach <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor Subscription Form Widget 'formId' Setting
- ID
- WPSEC-2026-0255
- Plugin
- Hostinger Reach – AI-Powered Email Marketing for WordPress (hostinger-reach)
- Affected
- from 1.0.6 before 1.8.3
- Remediation
- Update to 1.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Hostinger Reach on WPSec AttackSurface
- Fix released
- Published
Also published later by Another source as CVE-2026-87777, on 2026-09-28.
Description
The Hostinger Reach plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formId' setting of the Subscription Form Elementor widget in all versions up to, and including, 1.8.2 due to the widget's Elementor JavaScript template outputting the setting unescaped into HTML attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts that will execute in the Elementor editor preview whenever another user, such as an administrator, opens the affected page for editing.
References
- https://wpsec.com/vuln/WPSEC-2026-0255/
- https://plugins.svn.wordpress.org/hostinger-reach/tags/1.8.3/
- https://wordpress.org/plugins/hostinger-reach/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS