EUVD-2026-39706
GHSA-6vh2-4qp5-986m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable XSS needs no auth (PR:N) but a victim click (UI:R); scope changes to the browser context (S:C) with limited C/I/A impact (L).
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
AnalysisAI
Stored/reflected cross-site scripting in the WP Automatic WordPress plugin (versions before 3.135.1) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they visit or interact with a crafted resource. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script can affect components beyond the vulnerable plugin context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication (PR:N) but does require victim interaction (UI:R) - a user, typically a logged-in WordPress administrator or editor, must follow a crafted link or trigger the malicious request for the injected script to execute in their browser context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed-to-moderate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious link or request targeting the vulnerable WP Automatic endpoint with an XSS payload and lures a logged-in site administrator into clicking it (e.g., via email or a comment). When the admin's browser renders the unsanitized input, the injected JavaScript runs in their session and can perform actions such as creating rogue admin accounts or stealing session tokens. … |
| Remediation | Vendor-released patch: 3.135.1 - upgrade the WP Automatic plugin to 3.135.1 or later via the WordPress admin or the vendor's update channel as the primary fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations to identify WP Automatic usage and confirm current version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today