EUVD-2026-68154
GHSA-rmh2-mrxf-cjqv
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor-level access maps to PR:L; stored XSS enabling admin session hijacking represents a scope change (S:C); no availability impact results from XSS execution.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published.
AnalysisAI
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the SOGO Add Script to Individual Pages Header Footer plugin installed and active on a WordPress site running any version through 3.9; (2) the attacker must hold a valid WordPress account with at minimum contributor-level access - this is the critical prerequisite preventing unauthenticated exploitation; (3) for the admin-targeting vector, an administrator must actively open the submitted post for review, making UI interaction mandatory; (4) for the public visitor-targeting vector, an editor or administrator must approve and publish the post, since contributors cannot self-publish. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H, score 6.8) contains a notable internal inconsistency: PR:H (High privileges required) does not align with the description's explicit statement that contributor-level access is sufficient - contributor maps to PR:L in CVSS 3.1 terms. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been identified at time of analysis; patch status should be confirmed against the plugin's WordPress.org repository page and the WPScan advisory at https://wpscan.com/vulnerability/f0b869b1-ef43-4540-9ca5-4440e763d307/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today