Lifecycle Timeline
2DescriptionNVD
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Reflected XSS.This issue affects Wordpress Auto Spinner: from n/a through <= 3.26.0.
AnalysisAI
Reflected cross-site scripting (XSS) in ValvePress WordPress Auto Spinner plugin versions up to 3.26.0 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability exploits improper input neutralization during page generation, enabling attackers to steal session tokens, deface content, or redirect users to phishing sites through crafted URLs. No public exploit code has been identified, and exploitation likelihood is assessed as very low (EPSS 0.04%), suggesting this is a low-priority vulnerability despite the XSS classification.
Technical ContextAI
The vulnerability exists in the ValvePress WordPress Auto Spinner plugin, a WordPress plugin designed to automate content spinning and generation. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which indicates the plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML responses. Reflected XSS vulnerabilities of this type typically occur when user input from query parameters, POST data, or headers is directly echoed back to the browser without adequate output encoding, allowing attackers to inject arbitrary JavaScript code that executes in the context of the vulnerable application.
Affected ProductsAI
ValvePress WordPress Auto Spinner plugin through version 3.26.0 is affected. The vulnerability impacts all installations of this WordPress plugin running versions from the initial release through 3.26.0. Users can identify affected installations by checking the plugin version in their WordPress admin dashboard under Plugins. Further details and the vendor advisory are available at the Patchstack vulnerability database entry https://patchstack.com/database/Wordpress/Plugin/wp-auto-spinner/vulnerability/wordpress-wordpress-auto-spinner-plugin-3-25-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
RemediationAI
Update the WordPress Auto Spinner plugin to the patched version released after 3.26.0 through the WordPress plugin repository or directly via the admin dashboard. If automatic updates are disabled, navigate to Plugins > Installed Plugins, locate WordPress Auto Spinner, and click Update Now. As a temporary mitigation pending patch deployment, administrators should disable the plugin if it is not actively used, or restrict access to administrative pages through IP whitelisting or HTTP authentication. Refer to the Patchstack advisory for confirmation of the patched version number and installation instructions.
Share
External POC / Exploit Code
Leaving vuln.today