Rps Include Content Vulnerabilities

The RPS Include Content plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.2.2

Fix:

No patched version reported

Disclosed:

Feb 14, 2026

CVE-2026-39639 on NVD →

The RPS Include Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pa...

CVSS:

6.4

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Mar 28, 2025

CVE-2025-31093 on NVD →