EUVD-2026-75962
GHSA-prhq-gjf4-2hw3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable stored XSS requiring subscriber auth (PR:L), victim page-load (UI:R), scope change to visitor browsers (S:C), with limited C/I impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.
AnalysisAI
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid WordPress account at subscriber level or above - exploitation is not possible against unauthenticated visitors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 score (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) accurately captures the moderate severity: exploitation requires a valid subscriber account (PR:L) and a victim must load the poisoned product page (UI:R), limiting mass opportunistic abuse. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Advanced Customized Prompts
View allAuthentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticat
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any aut
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today