{"action":"Upgrade johnbillion/query-monitor to 3.20.4 or later.","affected":[{"fixed":"3.20.4","introduced":"0"}],"component":"johnbillion/query-monitor","cve_ids":["CVE-2026-4267"],"ecosystem":"Packagist","epss":0.00405,"exploited":false,"fixed_versions":["3.20.4"],"ghsa_id":"GHSA-2xr4-chcf-vmvf","id":"tcs_01M5KESDSJY4HT47KZTDFRR797","modified_at":"2026-03-19T19:56:20.713169Z","published_at":"2026-03-19T19:37:04Z","references":["https://osv.dev/vulnerability/GHSA-2xr4-chcf-vmvf","https://github.com/johnbillion/query-monitor/security/advisories/GHSA-2xr4-chcf-vmvf","https://github.com/johnbillion/query-monitor"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2xr4-chcf-vmvf","url":"https://osv.dev/vulnerability/GHSA-2xr4-chcf-vmvf"}],"summary":"The Query Monitor plugin for WordPress has Reflected Cross-Site Scripting via Request URI"}