CVE-2026-1391 - Vzaar Media Management <= 1.2 - reflected cross-site scripting via $_server['php_...

CVE ID : CVE-2026-1391 Published : Jan. 28, 2026, 12:15 p.m. | 42 minutes ago Description : The Vzaar Media Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on the $_SERVER['PHP_SELF'] variable. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...