EUVD-2026-92580
GHSA-j25q-m3fw-5v57
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Authenticated low-priv user needed to store payload (PR:L), victim must view it (UI:R), script runs in victim browser crossing scope (S:C); XSS yields no real availability impact so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.
AnalysisAI
Stored cross-site scripting (XSS) in the Webful Creations RepairBuddy WordPress plugin (computer-repair-shop) through version 4.1225 allows an authenticated attacker with low-level privileges to inject malicious JavaScript into fields such as repair tickets or customer records. The payload is stored and later executed when a privileged user views the affected page, potentially leading to session hijacking or unauthorized actions on behalf of the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account on the target WordPress site with at least low-level privileges (PR:L) capable of submitting input the RepairBuddy / computer-repair-shop plugin stores and later renders - for example a repair-ticket, customer, or form field. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored (persistent) Cross-Site Scripting flaw (CWE-79) in the Webful Creations RepairBuddy / computer-repair-shop WordPress plugin, scored CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified in the available data; the advisory does not specify a fixed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Repairbuddy
View allRemote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holdi
Authenticated low-privilege users can retrieve embedded sensitive data from WordPress sites running the RepairBuddy plug
Broken access control in the RepairBuddy WordPress plugin (versions ≤ 4.1132) allows subscriber-level authenticated user
RepairBuddy plugin for WordPress versions through 4.1132 exposes sensitive data in network transmissions due to improper
Broken access control in the RepairBuddy WordPress plugin (versions up to and including 4.1223) allows unauthenticated r
Broken access control in the RepairBuddy WordPress plugin (versions through 4.1121) allows authenticated low-privileged
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today