EUVD-2026-14000
GHSA-4r2x-xpjr-7cvv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
The rexCrawler WordPress plugin contains a Reflected Cross-Site Scripting (XSS) vulnerability in the search-pattern tester page that allows unauthenticated attackers to inject arbitrary web scripts via inadequately sanitized 'url' and 'regex' parameters. Affected versions are up to and including 1.0.15 (CPE: cpe:2.3:a:larsdrasmussen:rexcrawler:*:*:*:*:*:*:*:*), with exploitation requiring social engineering to trick administrators into clicking a malicious link. This vulnerability is limited to WordPress multisite installations or sites where the unfiltered_html capability has been disabled, and carries a CVSS v3.1 score of 6.1 with an AV:N/AC:L/PR:N/UI:R/S:C profile indicating network-based exploitation with user interaction required.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where user-supplied input from HTTP parameters is rendered in HTML responses without proper sanitization or output encoding. The rexCrawler plugin, developed by larsdrasmussen for WordPress, implements a regex testing utility (admin_regex_test.php at lines 25 and 29 per plugin repository evidence) that directly echoes the 'url' and 'regex' query parameters into the page without escaping HTML entities or applying WordPress sanitization functions like sanitize_text_field() or esc_attr(). WordPress's unfiltered_html capability, when disabled or restricted in multisite environments, prevents administrators from directly embedding HTML, making client-side XSS payloads in plugin output exploitable even for high-privilege users who lack explicit script execution permissions.
RemediationAI
Update the rexCrawler plugin to a patched version released after 1.0.15; check the official WordPress plugin repository (https://plugins.wordpress.org/rexcrawler/) or Wordfence advisory for the fixed version number and installation instructions. The plugin author (larsdrasmussen) should have released a patch implementing proper input sanitization (via WordPress functions like sanitize_text_field()) and output escaping (via esc_attr() or esc_html()) on the 'url' and 'regex' parameters in admin_regex_test.php. Until patching is completed, administrators of affected WordPress installations should restrict access to the search-pattern tester page via firewall rules or web application firewall (WAF) rules blocking requests to admin_regex_test.php with URL or regex query parameters, and should audit access logs for evidence of exploitation attempts. Organizations unable to patch immediately should consider disabling the rexCrawler plugin entirely if its core functionality is not critical.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today