Dashboard / CVE-2026-9271

CVE-2026-9271

MEDIUM 1 PoC
MEDIUM Priority: 0.06 BB Relevance: 59/100
Published: 2026-06-12 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network Low Complexity Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Required
S: Unchanged
C: High
I: High
A: High

Description

The KeepInMind Dashboard Notes WordPress plugin through 0.8.5 does not properly sanitize note content submitted through its REST API, allowing users with a low-privileged role (such as Contributor, where an administrator has enabled it) to store CSS that redresses the administrator dashboard for credential phishing and denial of service; the fix released in 0.8.4.2 addressed only the editor interface and left the REST write path exploitable.

Affected Software (1)

VendorProductVersion
Unknown KeepInMind Dashboard Notes 0

References & Advisories (1)

Proof of Concept (1)

★ 1
https://github.com/CerberusMrXi/WordPress-KeepInMind-CVE-2026-9271-Exploit
nomi-sec

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ PoC available (1)

CVSS Score

6.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.87%
Raw Score 0.008680
Percentile 59.3%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00868
2026-11-12
0.00707

Intelligence Sources

mitre ref →
nvd ref →

External Links