RCE in Staggs

CVE-2026-78287

Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.

Vulnerability class: RCE (Remote Code Execution)

Published 2026-11-11 · last modified 2026-11-12.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Staggs

Weakness classification (CWE)

CWE-94 — Code Injection

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

evenomn/CVE-2026-78287 (last pushed 2026-11-12)

References

patchstack.com/database/wordpress/plugin/staggs/vulnerability/wordpress-staggs-… (vdb-entry)

This CVE has public exploit evidence. See the latest CVEs with public exploits.