Platform
wordpress
Component
penci-data-migrator
Fixed in
1.3.2
CVE-2026-27054 describes a Reflected Cross-Site Scripting (XSS) vulnerability discovered in the Penci Soledad Data Migrator plugin for WordPress. This flaw allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to account compromise and data theft. The vulnerability affects versions from 0.0.0 up to and including 1.3.1, and a patch is expected from the vendor.
The primary impact of this Reflected XSS vulnerability is the ability for an attacker to execute arbitrary JavaScript code within the context of a victim's browser session. This can be exploited to steal cookies, redirect users to phishing sites, or deface the website. An attacker could craft a malicious URL containing the XSS payload and trick a user into clicking it, either through social engineering or by embedding the URL in a legitimate-looking email. Successful exploitation could lead to unauthorized access to user accounts and sensitive data stored within the WordPress site. The blast radius extends to all users who interact with the vulnerable page.
CVE-2026-27054 was publicly disclosed on 2026-03-25. As of this date, no public proof-of-concept (PoC) exploits have been identified. The EPSS score is pending evaluation. Monitor security advisories and vulnerability databases for updates on exploitation activity.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The immediate mitigation for CVE-2026-27054 is to upgrade the Penci Soledad Data Migrator plugin to a patched version as soon as it becomes available. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the vulnerable page to sanitize user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block XSS payloads can also provide a temporary layer of protection. Monitor WordPress logs for suspicious activity, particularly requests containing unusual characters or scripts.
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27054 is a Reflected XSS vulnerability affecting the Penci Soledad Data Migrator plugin for WordPress, allowing attackers to inject malicious scripts.
You are affected if you are using Penci Soledad Data Migrator versions 0.0.0 through 1.3.1. Check your plugin version and upgrade immediately.
Upgrade the Penci Soledad Data Migrator plugin to the latest available version. If upgrading is not possible, implement input validation and output encoding as temporary mitigations.
As of the disclosure date, no active exploitation has been confirmed, but it is crucial to apply the patch promptly to prevent potential attacks.
Refer to the PenciDesign website or WordPress plugin repository for the official advisory and updated plugin version.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.