ReactPress – Create React App for WordPress
ReactPress – Create React App for WordPress has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; none of them are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
None of the 2 issues recorded for ReactPress – Create React App for WordPress have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
2 independent researchers contributed these findings, one record each. ReactPress – Create React App for WordPress is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.9.
CVE-2026-92712ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
Read the full analysisVulnerability Records
ReactPress – Create React App for WordPress
Author
rockiger
ReactPress enables you to easily create, build and deploy React apps into your existing WordPress sites. Use your React knowledge to create single page applications for your WordPress customers. Get started in seconds and develop your React app with instant feedback and your WordPress theme in mind. Combine the flexibility of WordPress with the UI capabilities of React and seamlessly integrate create-react-app into your WordPress project for your next SaaS. ReactPress does 3 things: It integrates your local dev server into your WordPress theme, that you have instant feedback, how your React app looks in the context of your WordPress website. It builds your React app in a way that it is usable from your WordPress site. It makes it easy to upload your app to a live server after building. Features Fast refresh during app development WordPress integration during development Easy deploy to your live site client-side routing zero-config TypeScript support Links Website Getting Started In depth React with WordPress Tutorial FAQ Development System Requirements To develop React apps your WordPress instance needs access to: Access to the PHP function file_get_contents. Some hosting providers deactivate fopen on which file_get_contents depends. Access to file_get_contents is neccessary on your dev and your live system! POSIX compatible system, Windows support is experimental. (Alternatively Windows users can use WSL2)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C