BE REST Endpoints allows unauthenticated stored script injection
BE REST Endpoints through 1.0.0 exposes widget read, create, update, and delete operations without authorization and stores widget values without sanitization. An unauthenticated attacker can save JavaScript that executes for visitors to the affected site. The authoritative export does not identify the REST route, request fields, widget store, or rendering sink.
- Component
- BE REST Endpoints
- Plugin slug
be-rest-endpoints- Affected
- <= 1.0.0
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fixed release is confirmed in the authoritative export. Deactivate the plugin and remove untrusted widget content. The application-level fix must authenticate and authorize each widget operation, sanitize stored values for their context, and escape them at render time.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H