What is the CVSS score of CVE-2026-24948?

CVE-2026-24948 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-24948?

A reflected cross-site scripting (XSS) vulnerability exists in the Reflector plugin (versions ≤1.2.2) that could allow attackers to inject malicious code into web pages viewed by your users.

How to fix or mitigate CVE-2026-24948?

Within 24 hours: Identify all systems running Reflector plugin version 1.2.2 or earlier and disable the plugin if operationally feasible. Within 7 days: Implement input validation and output encoding controls; deploy WAF rules to block XSS payloads; communicate risk to affected users and advise on credential rotation. Within 30 days: Monitor vendor (fox-themes) for patch availability and prepare deployment plan; conduct security assessment of plugin code for similar vulnerabilities; evaluate alternative plugins for replacement.

Wordpress Plugin CVE-2026-24948

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-02-20 audit@patchstack.com

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 16:22 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Reflector reflector-plugins allows Reflected XSS.This issue affects Reflector: from n/a through <= 1.2.2.

AnalysisAI

Reflected XSS in fox-themes Reflector plugin versions up to 1.2.2 enables attackers to inject malicious scripts into web pages viewed by victims, potentially allowing theft of session cookies, credentials, or sensitive data through user interaction. The vulnerability requires no authentication and can spread across security boundaries, affecting all users who click malicious links. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects fox-themes Reflector reflector-plugins. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Reflector reflector-plugins allows Reflected XSS.This issue affects Reflector: from n/a through <= 1.2.2.

Affected ProductsAI

Product: fox-themes Reflector reflector-plugins.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.