What is the CVSS score of CVE-2026-56045?

CVE-2026-56045 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Automatic are affected by CVE-2026-56045?

WP Automatic, a widely-used WordPress plugin, contains a cross-site scripting vulnerability affecting versions before 3.135.1 that allows unauthenticated attackers to inject harmful code into website…. A patch is available.

How to fix or mitigate CVE-2026-56045?

Within 24 hours: audit all WordPress installations to identify WP Automatic usage and confirm current version. Within 7 days: deploy WP Automatic version 3.135.1 or later to all affected systems; validate updates with security testing on staging environment first. Within 30 days: review server access logs and WordPress audit trails on affected sites from 90 days prior to patch date for indicators of exploitation (unauthorized accounts, suspicious post modifications, scanner payloads in logs).

WP Automatic CVE-2026-56045

EUVD-2026-39706 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-6vh2-4qp5-986m

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable XSS needs no auth (PR:N) but a victim click (UI:R); scope changes to the browser context (S:C) with limited C/I/A impact (L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:01 vuln.today

Patch available

Jun 26, 2026 - 16:01 EUVD

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.

AnalysisAI

Stored/reflected cross-site scripting in the WP Automatic WordPress plugin (versions before 3.135.1) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they visit or interact with a crafted resource. The CVSS 3.1 score is 7.1 with a scope change (S:C), reflecting that injected script can affect components beyond the vulnerable plugin context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

WP Automatic (the 'Automatic' / wp-automatic plugin by ValvePress) is a WordPress content-aggregation and auto-posting plugin that imports content from external sources into a WordPress site. The flaw is classed as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled input is rendered back into HTML/JS output without adequate sanitization or output encoding. Because no authentication is required (PR:N) but user interaction is (UI:R), this behaves like a reflected or DOM-based XSS where a crafted request/link, once followed by a victim, causes script execution in their authenticated session, with the CVSS scope change (S:C) indicating the executed script can reach security-relevant context outside the plugin's own boundary (e.g., the WordPress admin DOM).

RemediationAI

Vendor-released patch: 3.135.1 - upgrade the WP Automatic plugin to 3.135.1 or later via the WordPress admin or the vendor's update channel as the primary fix. If immediate patching is not possible, reduce exposure by restricting access to the plugin's affected endpoints/pages at the web server or WAF layer, deploying a WAF/virtual-patch rule that filters XSS payloads in the relevant parameters (trade-off: rules can be bypassed and may cause false positives on legitimate content imports), and applying a strict Content-Security-Policy to limit inline-script execution (trade-off: CSP can break legitimate plugin or theme scripts and requires testing). Where the plugin is non-essential, temporarily deactivating it eliminates the risk at the cost of losing auto-import functionality. Refer to the Patchstack advisory above for details: https://patchstack.com/database/wordpress/plugin/wp-automatic/vulnerability/wordpress-automatic-plugin-3-135-1-cross-site-scripting-xss-vulnerability.