Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

johnbillion/query-monitor

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1PackagistPublished

    The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI

    CVE-2026-4267 · GHSA-2xr4-chcf-vmvf

    Affected
    • Packagist johnbillion/query-monitor < 3.20.4
    Fixed in
    3.20.4· Vendor fix available
    Issue
    Impact The Query Monitor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER['REQUESTURI'] parameter in all versions up to, and including, 3.20.3 due to insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an Administrator-level user into performing an action such as clicking on a link. On admin requests, the plugin reads user controlled data from $SERVER['REQUESTURI'] and stores it in the request field, then renders request, matchedquery, and querystring through formaturl(). If the attacker supplied string does not contain &, formaturl() returns it without HTML escaping, which allows injected HTML or JavaScript from the request target to be inserted directly into the page inside a <code element and executed in the victim's browser. Patches This issue has been patched in Query Monitor 3.20.4. Credits Many thanks to Dmitrii Ignatyev at…

    Recommended action: Upgrade to 3.20.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →