EUVD-2026-55026
GHSA-6gq8-gfgv-846h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor authentication (PR:L) and admin interaction (UI:R) are required; scope change (S:C) reflects execution in a distinct privileged browser session; no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content.
AnalysisAI
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic stored XSS root cause. WordPress plugins that register custom post meta are expected to sanitize on save (e.g., sanitize_text_field()) and escape on output (e.g., esc_html(), esc_attr(), or wp_kses()) before rendering values in the admin UI. The Saitama Addon Pack omits the output-escaping step for certain metadata fields, meaning raw HTML and JavaScript stored by a contributor is faithfully reproduced in the browser of any privileged user who reviews the post. The CPE string cpe:2.3:a:unknown:saitama_addon_pack:*:*:*:*:*:*:*:* confirms NVD coverage but the vendor field is listed as 'unknown', indicating limited vendor attribution in the national database. The scope change in the CVSS vector (S:C) is technically correct: the injection executes in the context of a different security principal (the admin's authenticated session), extending impact beyond the plugin itself.
RemediationAI
Update the Saitama Addon Pack plugin to any release newer than 1.0.8 once available from the WordPress plugin repository or the plugin author's distribution channel. No specific patched version number is confirmed in the available references - the WordPress.org plugin changelog should be verified directly before upgrading. If no patched release exists, the most effective compensating control is to disable the plugin entirely until a fix is published, as there is no known partial workaround that preserves plugin functionality while eliminating the unsanitized output path. If disabling the plugin is not operationally feasible, restrict contributor-level role assignment to explicitly trusted users only, and consider deploying a WordPress-aware WAF such as Wordfence (free tier) or WP Cerber with XSS input rules enabled on post meta fields - note that WAF rules add latency and may produce false positives on legitimate shortcode or HTML meta content. Removing open user registration (Settings → General → uncheck 'Anyone can register') eliminates the attack surface for external threat actors. See https://wpscan.com/vulnerability/1e760dbf-7efc-4511-9a05-2d1476eb3dfb/ for ongoing disclosure updates.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today