CVE: CVE-2026-0734 CVSS: 4.4 (Medium) Publicly Published: January 13, 2026 Last Updated: January 14, 2026 Researcher: 0x34rth Vulnerability Type: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Description: The WP Allowed Hosts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'allowed-hosts' parameter in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. Affected Plugin: WP Allowed Hosts Software Slug: wp-allow-hosts Patched?: No Remediation: No known patch available. Review vulnerability details and employ mitigations based on organization's risk tolerance. Consider uninstalling the affected software. Affected Version: <= 1.0.8