CVE-2026-0743 Details.
WP Content Permission <= 1.2 - Cross-Site Scripting
Atlas does not check this one. Needs requests that change data.
To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check.
About CVE-2026-0743. What It Means.
The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Product. What Is Hit.
- Vendor
- orenhav
- Product
- Orenhav WP Content Permission
References. Where To Read More.
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e44403cd-1cee-43c4-aabc-3eaad433c020?source=cve
- https://plugins.trac.wordpress.org/browser/wp-content-permission/tags/1.2/admin/views/admin.php#L74
- https://plugins.trac.wordpress.org/browser/wp-content-permission/trunk/admin/views/admin.php#L74
- https://nvd.nist.gov/vuln/detail/CVE-2026-0743
FAQ
Common Questions.
WP Content Permission <= 1.2 - Cross-Site Scripting. The WP Content Permission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ohmem-message' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
No. To test for this one, the check would have to send requests that could change data on the site. Atlas only ever reads public pages, so it does not run this check. The facts about CVE-2026-0743 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-0743 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Orenhav WP Content Permission to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-0743. Atlas does not run a check for it, so nothing here says whether a particular site is affected.