{"id":"CVE-2026-94294","published":"2026-10-19T07:16:32.950","lastModified":"2026-10-19T21:02:51.987","description":"The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/26ac49f1-657b-49ab-937b-1ceabde1e891/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}