EUVD-2026-50986
GHSA-v8w8-2g4c-qjc5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection (AV:N/PR:N), no complexity barrier (AC:L), admin must view settings page (UI:R), XSS executes in admin browser triggering scope change (S:C), with session-limited confidentiality and integrity impact (C:L/I:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page.
AnalysisAI
Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:unknown:wp_real_ip-based_access_control:*:*:*:*:*:*:*:* - notably, the vendor field is 'unknown', indicating the plugin lacks a well-established vendor identity in the NVD database, consistent with a niche or lesser-known WordPress plugin. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored (persistent) variant. WordPress plugins are expected to use the nonce mechanism (wp_nonce_field / check_admin_referer) and capability checks (current_user_can) before processing any option updates via the Settings API or direct database writes. This plugin performs neither validation step, meaning any HTTP client - authenticated or not - can POST to the relevant AJAX or admin-post endpoint. The stored value is then rendered back on the settings page without apply_filters('esc_html') or equivalent WordPress escaping functions, completing the classic stored XSS sink.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version number appears in the WPScan advisory, NVD CPE data, or any referenced source. Site administrators should immediately deactivate and remove the WP Real IP-based Access Control plugin (all versions ≤ 1.3.1) until a patched release is confirmed by the vendor. As a compensating control, restrict access to the WordPress admin panel (wp-admin) by IP allowlist at the web server or WAF layer, which eliminates the attacker's ability to reach the option-storing endpoint entirely; however, this may impact legitimate remote administration. Deploying a WordPress-aware WAF rule to block unauthenticated POST requests to wp-admin endpoints or plugin-specific AJAX actions provides a secondary control. Monitor the WPScan advisory at https://wpscan.com/vulnerability/5f2fb7cd-5330-4721-ab1b-d8c247786c8f/ and the plugin's repository for a patched release.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today