CVE-2026-4267: The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI

medium Affects johnbillion/query-monitor. Feed 2026.10.29.1, updated 2026-10-28; published 2026-03-19.

The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI

Package: johnbillion/query-monitor Composer
Affected versions: <3.20.4
Fixed in: 3.20.4
Severity: medium CVSS 6.1
Exploitation: not on CISA KEV · EPSS 0% (23.5th percentile)
Published: 2026-03-19
Source: osv.dev

References

NVD record johnbillion/query-monitor advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2024-4439 high WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the same weakness: CWE-80
CVE-2021-39348 medium The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insuff same weakness: CWE-80
CVE-2020-4047 medium In affected versions of WordPress, authenticated users with upload permissions (like autho same weakness: CWE-80
CVE-2020-4049 low In affected versions of WordPress, when uploading themes, the name of the theme folder can same weakness: CWE-80
CVE-2020-4046 medium In affected versions of WordPress, users with low privileges (like contributors and author same weakness: CWE-80
CVE-2022-0989 high An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress same weakness: CWE-80