What is the CVSS score of CVE-2026-1877?

CVE-2026-1877 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1877

EUVD-2026-17321 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-31 Wordfence

WordPress CSRF XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 06:00 euvd

EUVD-2026-17321

Analysis Generated

Mar 31, 2026 - 06:00 vuln.today

CVE Published

Mar 31, 2026 - 05:28 nvd

MEDIUM 6.1

DescriptionCVE.org

The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84. This is due to missing nonce validation on the 'aps_options_page' function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-site request forgery in Auto Post Scheduler WordPress plugin versions up to 1.84 allows unauthenticated attackers to modify plugin settings and inject malicious scripts by tricking site administrators into clicking a malicious link, due to missing nonce validation in the aps_options_page function. The vulnerability combines CSRF with stored XSS capability, affecting any WordPress site running the vulnerable plugin. CVSS 6.1 reflects the requirement for user interaction and the limited direct impact, though the ability to inject web scripts poses a meaningful risk to site integrity and user security.

Technical ContextAI

The Auto Post Scheduler plugin (CPE: cpe:2.3:a:johnh10:auto_post_scheduler:*:*:*:*:*:*:*:*) fails to implement WordPress nonce verification on its aps_options_page function, which processes settings updates. The underlying root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), compounded by missing CSRF protections. WordPress nonces are time-limited tokens that validate that form submissions originate from authenticated sessions within the WordPress application. Without nonce validation, an attacker can craft HTML/JavaScript that causes an authenticated administrator's browser to submit malicious requests to the plugin's settings handler. The vulnerability chain involves both CSRF (forcing unintended state changes) and XSS (injecting scripts through those state changes into settings that are later rendered). The specific vulnerable code path is in the options page handler at lines 200 and 962 of the plugin's main file.

RemediationAI

Update the Auto Post Scheduler plugin to version 1.85 or later, which includes nonce validation on the aps_options_page function. Site administrators should immediately upgrade via the WordPress admin dashboard (Plugins > Installed Plugins > Auto Post Scheduler > Update) or from the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/auto-post-scheduler/. Until patched, administrators should monitor plugin settings for unauthorized changes and review site users and capabilities for unexpected modifications. Additional hardening includes restricting admin dashboard access by IP address and using WordPress security plugins to detect CSRF attempts.