CVE-2026-1808 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Orange Confort+ accessibility toolbar for WordPress plugin, versions 0.7 and earlier. This flaw allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages via the 'style' parameter of the ocplus_button shortcode. The vulnerability stems from insufficient input sanitization and output escaping, leading to script execution when a user views an affected page. Rated with a CVSS score of 6.4 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring low privileges and no user interaction. Successful exploitation could lead to limited impact on confidentiality and integrity (C:L/I:L). The EPSS score is very low, indicating a minimal probability of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit or ExploitDB. Community discussion and media coverage for this CVE are also absent, which is typical for the vast majority of vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Ravanh | Orange Comfort+ Accessibility Toolbar For WordPress | >= 0, <= 0.7CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.