CVE-2026-86801 To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
Unauthenticated attackers can inject malicious scripts and manage files via an unprotected upload handler in the To Do List Member plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-86801?
CVE-2026-86801 is a high-severity cross-site scripting vulnerability in Unknown To Do List Member, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
Weakness: CWE-306
Which versions are affected by CVE-2026-86801?
How do I fix CVE-2026-86801?
No fix has been published for CVE-2026-86801 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-86801 being exploited?
There is no known exploitation of CVE-2026-86801 in the wild and no public exploit code.
Sources
Also known as GHSA-347f-487h-46gq.