Description The InputFilter::getInstance() method omitted a security sensitive parameter from the instance cache key. Remediation References CVE-2026-48901 Related Vulnerabilities WordPress Plugin DMSGuestbook Multiple Remote Vulnerabilities (1.8.0) WordPress Plugin Form Maker by 10Web-Mobile-Friendly Drag & Drop Contact Form Builder Cross-Site Scripting (1.13.59) Grafana Incorrect Privilege Assignment Vulnerability (CVE-2025-41115) WordPress Plugin Easy Social Box/Page Cross-Site Scripting (4.1.2) YetiForce CRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-3002) Severity High Classification CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Tags Missing Update Known Vulnerabilities CWE-524 CVE-2026-48901