CVE-2026-78333

12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.

We have discovered 52 live websites that are affected by CVE-2026-78333.

Run a Free Instant Scan



Affected Software

Product  12 Step Meeting List
Category Wordpress Plugins
Vulnerable Domains52 live websites (79% of 12 Step Meeting List install base)
Vulnerable Versions
  • from 3.17 through 3.19.17
Vulnerable Versions Count5 versions ( 71% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 27, 2026
  • Updated - Aug 27, 2026

Credits

  • Huseyn (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-78333
United States38 websites


Canada6 websites
Austria1 websites
Cyprus1 websites
Germany1 websites
GB1 websites
Poland1 websites
Romania1 websites

Website Distribution by TLD

Number of websites using CVE-2026-78333
.org34 websites
.com10 websites
.ca3 websites
.at1 websites
.de1 websites
.org.uk1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-78333

Top websites that are affected by CVE-2026-78333. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.at Austria***,***
*********.org Canada*,***,***
****.**.***.pl Poland*,***,***
**********.org United States*,***,***
***************.com United States*,***,***
****************.com United States**,***,***
***************************.de Germany**,***,***
**********.org United States**,***,***
***********************.org Canada**,***,***
******************.org United States**,***,***
See full domain list

FAQ

CVE-2026-78333 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 12 Step Meeting List
A total of 52 websites have been identified as vulnerable to CVE-2026-78333, based on global website indexing conducted by WebTechSurvey.
The 12 Step Meeting List is affected by the CVE-2026-78333 vulnerability.
12 Step Meeting List versions up to 3.19.17 are vulnerable to CVE-2026-78333.
CVE-2026-78333 is resolved in version 3.19.17 of 12 Step Meeting List.