What is the CVSS score of CVE-2026-2466?

CVE-2026-2466 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2466?

A reflected cross-site scripting vulnerability in the DukaPress WordPress plugin could allow attackers to compromise administrator accounts through malicious links, potentially granting unauthorized…

How to fix or mitigate CVE-2026-2466?

Within 24 hours: Disable the DukaPress plugin if not actively required for business operations, or restrict admin access to trusted networks only. Within 7 days: Audit all DukaPress plugin usage across your WordPress installations and document business justification for each deployment; contact the plugin vendor for patch availability and timeline. Within 30 days: Either apply a vendor-supplied patch immediately upon release, or deactivate and replace the plugin with a patched alternative; implement Web Application Firewall rules to filter malicious payloads targeting the vulnerable parameter.

WordPress CVE-2026-2466

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 contact@wpscan.com

WordPress XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 06:17 nvd

HIGH 7.1

DescriptionCVE.org

The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

AnalysisAI

DukaPress WordPress plugin versions up to 3.2.4 contain a reflected XSS vulnerability due to improper input sanitization and output encoding, allowing attackers to inject malicious scripts that execute in the browsers of high-privilege users like administrators. The vulnerability requires user interaction to exploit and can result in session hijacking, credential theft, or unauthorized administrative actions. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects DukaPress WordPre. The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Affected ProductsAI

Product: DukaPress WordPre. Versions: up to 3.2.4.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.