What is the CVSS score of CVE-2026-1451?

CVE-2026-1451 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

rognone WordPress Plugin CVE-2026-1451

EUVD-2026-33897 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Wordfence

GHSA-v659-wj3w-h29v

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:47 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the rognone plugin for WordPress (versions up to and including 0.6.2) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link containing a malicious 'a' parameter. The vulnerability originates in header.php at line 74, where user-supplied input is reflected into page output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.

Technical ContextAI

The rognone plugin (CPE: cpe:2.3:a:federicocarrara:rognone) is a WordPress plugin authored by federicocarrara. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant, meaning attacker-controlled input from the HTTP request is echoed directly into the HTML response without adequate encoding. The vulnerable sink is the 'a' GET parameter processed in header.php (line 74, confirmed in plugin trac at both trunk and the 0.6.2 tagged release). The WordPress plugin architecture means this code executes server-side within the PHP runtime and outputs to the browser, making the injected payload subject to the same-origin policy of the hosting WordPress site. The Scope:Changed (S:C) in the CVSS vector reflects that a successful exploit can affect resources beyond the plugin's own security domain - specifically the broader WordPress session context in the victim's browser.

RemediationAI

No vendor-released patched version of the rognone plugin has been identified at time of analysis - the available references document the vulnerable code but do not reference a fixed release. Site administrators should immediately deactivate and remove the rognone plugin from their WordPress installations until a patched version is confirmed available. Disabling the plugin eliminates the attack surface entirely with no functionality trade-off beyond losing plugin features. As a secondary compensating control, a Web Application Firewall (WAF) rule blocking requests where the 'a' parameter contains script-injection patterns (e.g., Wordfence's own firewall) can reduce exploitation risk without removing the plugin, though WAF-based mitigations can be bypassed by sufficiently obfuscated payloads. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d122321a-d714-4283-89b8-dc7dbfa96b20 for patch availability.