What is the CVSS score of CVE-2026-2719?

CVE-2026-2719 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Private WP Suite CVE-2026-2719

EUVD-2026-24638 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-84px-h8hx-j764

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24638

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.4

DescriptionCVE.org

The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored cross-site scripting in Private WP Suite plugin for WordPress through version 0.4.1 allows authenticated administrators to inject arbitrary JavaScript via the Exceptions setting, which executes in the browsers of any user accessing affected pages. The vulnerability requires high-privilege authenticated access and only manifests in multi-site installations or those with unfiltered_html disabled, limiting real-world exposure despite network-accessible attack vector.

Technical ContextAI

The Private WP Suite WordPress plugin fails to properly sanitize and escape user input in the Exceptions configuration setting. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where attacker-controlled data is saved to the database and later rendered in HTML context without sanitization. WordPress plugins typically use functions like sanitize_text_field() during input and wp_kses_post() or esc_attr() during output; this plugin appears to use neither for the Exceptions field. The CPE cpe:2.3:a:fpoller:private_wp_suite:*:*:*:*:*:*:*:* identifies all versions of this WordPress plugin as affected through 0.4.1. Multi-site WordPress installations are specifically mentioned because they may have different sanitization rules or restrictions on HTML content compared to single-site setups.

RemediationAI

Update Private WP Suite to version 0.4.2 or later when available. If an immediate update is not possible, restrict the Exceptions setting to non-administrator users by implementing role-based access controls via WordPress capability filters, or disable the Exceptions feature entirely if it is not critical to operations. Additionally, ensure that unfiltered_html is enabled for trusted administrator accounts (if organizational policy permits) to reduce the attack surface, though this is a weak compensating control. For multi-site installations specifically, enforce strict content policies and regularly audit administrator accounts for unauthorized changes to the Exceptions field. Monitor page output for unexpected script tags as a detective control. The primary remediation remains patching; check the WordPress plugin repository or fpoller's official channels for patch release version numbers.