Medium severity · published Oct 29, 2026
CVE-2026-116849
WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
New
6.5
CVSS
–
EPSS
No
On KEV
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
StreamCast · bPlugins
through 2.4.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116849
patchstack.com
https://patchstack.com/database/wordpress/plugin/streamcast/vulnerability/wordpress-streamcast-plugin-2-4-6-cross-site-scripting-xss-vulnerability?_s_id=cve
More from StreamCast
7.2
CVE-2026-62030
WordPress StreamCast plugin <= 2.4.5 - Server Side Request Forgery (SSRF) vulnerability
5.9
CVE-2024-43148
WordPress StreamCast <= 2.2.3 - Stored Cross Site Scripting (XSS) vulnerability