What is the CVSS score of CVE-2026-2280?

CVE-2026-2280 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

rexCrawler WordPress Plugin CVE-2026-2280

EUVD-2026-32173 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-3xwf-6qxg-mrv7

XSS WordPress

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:21 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 4.8

DescriptionCVE.org

The rexCrawler plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in the rexCrawler WordPress plugin (versions ≤ 1.0.15) allows authenticated administrators to inject persistent malicious scripts into settings pages, which then execute in the browsers of any user who accesses those pages. The vulnerability originates in admin_main.php at two distinct injection points (lines 108 and 239) and is constrained to multi-site WordPress environments or single-site installs where the unfiltered_html capability has been explicitly disabled. With an EPSS of 0.02% (7th percentile), no CISA KEV listing, and SSVC exploitation status of 'none', this represents a low-urgency finding despite its network-accessible attack vector. No public exploit code has been identified at time of analysis.

Technical ContextAI

The rexCrawler plugin for WordPress implements a web crawling feature configured via an admin settings interface rendered in admin_main.php. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause - specifically, the plugin fails to sanitize values written to the settings form and fails to escape them on output, allowing raw HTML/JavaScript to persist in the WordPress database and render in the admin UI. The Stored XSS variant (as opposed to Reflected) is particularly relevant here because the payload survives across sessions and affects any user who later loads the injected page, not just the attacker. The S:C (Changed Scope) flag in the CVSS vector confirms cross-boundary impact: the injected script runs in victim browser sessions outside the attacker's own administrative context. WordPress's unfiltered_html capability normally permits administrators to post arbitrary HTML, which is why this only manifests as a security issue when that capability is revoked (e.g., in multi-site networks where super-admin may restrict site admins) or when it is explicitly disabled.

RemediationAI

No confirmed patched release version is independently verifiable from the available data - the NVD references point to both the 1.0.15 tagged release and the trunk branch of the plugin's Trac repository, but no tagged release superseding 1.0.15 is cited. Administrators should monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/browser/rexcrawler/) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/9ec307de-600c-4fb2-b474-db9b674d4ead) for a patched release and upgrade immediately upon availability. As a compensating control, restrict administrator account creation and enforce multi-factor authentication for all WordPress administrator accounts to raise the effective bar for an attacker to reach the required privilege level; note this does not eliminate the vulnerability but materially reduces exposure. In multi-site environments, review site administrator role assignments and audit whether any sites grant unfiltered_html unnecessarily - revoking it on sites that don't require it is safe but confirms the vulnerability condition is present. Consider deploying a Web Application Firewall rule (e.g., via Wordfence) targeting stored XSS patterns in wp-admin settings submissions as a detection and mitigation layer.