CVE-2026-86801 — To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler

CVE-2026-86801

To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler PUBLISHED

Description (CNA)

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.

Affected (CNA)

Vendor / product	Versions
Unknown / To Do List Member	affected 1.4 through 1.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/baebde16-141c-4de4-8ecb-173c25bed40d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.