CVE-2026-1450: Reflected XSS in WordPress rogone plugin <= 0.6.2

Vulnerability Overview Vulnerability Name: rogone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter CVE ID: CVE-2026-1450 CVSS Score: 6.1 (Medium) Published Date: June 1, 2026 Last Updated: June 2, 2026 Researchers: san6051 - COFFSec Impact Scope Software Type: Plugin Software Name: rogone Affected Versions: <= 0.6.2 Patch Status: Unfixed Remediation Current Status: No known patch is available Recommended Measures: Please review the vulnerability details carefully and implement mitigation measures based on your organization's risk tolerance. It is recommended to uninstall the affected software and seek alternatives. References plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Wordfence Intelligence: Offers free personal and commercial API access, along with the latest vulnerability database and Webhook integrations. Support: 24/7 support available 365 days a year, with a 1-hour response time. Copyright Information Copyright: 2012-2026 Defiant Inc. License: Use subject to Defiant Inc.'s license terms. Contact Us Technical Support: info@support@wordfence.com Social Media Facebook: Wordfence Twitter: Wordfence LinkedIn: Wordfence Email: Wordfence Footer Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Products & Services Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscription Stay Updated: Register to receive news and updates curated by experienced security professionals. Disclaimer Copyright: 2012-2026 Defiant Inc. All Rights Reserved Other Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-11pm UTC/GMT, excluding weekends and holidays. Response Customers: 24-hour support, 365 days a year, with a 1-hour response time. Summary This vulnerability is a Reflected Cross-Site Scripting (XSS) issue affecting the rogone plugin versions <= 0.6.2. There are currently no known patches available; it is recommended to uninstall the affected software and seek alternatives. Wordfence Intelligence offers free API access and an up-to-date vulnerability database, with 24/7 all-day service support.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-1450: Reflected XSS in WordPress rogone plugin <= 0.6.2