What is the CVSS score of CVE-2026-57337?

CVE-2026-57337 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Landing Page Builder are affected by CVE-2026-57337?

The PluginOps Landing Page Builder WordPress plugin contains an unauthenticated cross-site scripting vulnerability affecting versions 1.5.3.5 and earlier, allowing attackers to inject malicious…

How to fix or mitigate CVE-2026-57337?

24 hours: Audit all WordPress installations for PluginOps Landing Page Builder versions ≤1.5.3.5; disable the plugin immediately if discovered. 7 days: Contact PluginOps for patch availability and ETA; deploy Web Application Firewall rules to detect and block XSS payloads in page builder form inputs. 30 days: Complete migration to an alternative landing page builder if PluginOps has not released a patched version.

Landing Page Builder CVE-2026-57337

EUVD-2026-40108 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-77c2-57x5-fjmg

WordPress XSS Wordpress Plugin Landing Page Builder Pluginops

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (AV:N/PR:N) needing victim click (UI:R); browser-context script execution with scope change (S:C) and limited C/I/A impact (all Low).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:18 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Landing Page Builder <= 1.5.3.5 versions.

AnalysisAI

Cross-site scripting in the PluginOps Landing Page Builder WordPress plugin (versions <= 1.5.3.5) lets unauthenticated remote attackers inject script that executes in a victim's browser, with a scope change (S:C) indicating the payload can affect resources beyond the vulnerable component. The flaw requires victim interaction (UI:R) such as visiting a crafted link or page, and yields low-level confidentiality, integrity, and availability impact (CVSS 7.1). No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the PluginOps Landing Page Builder (CPE cpe:2.3:a:pluginops:landing_page_builder), a WordPress drag-and-drop page-building plugin used to create marketing and landing pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where attacker-controlled input is reflected or stored into rendered HTML without proper output encoding or sanitization, allowing browser execution of arbitrary JavaScript. Because the CVSS vector reports a scope change (S:C), the executed script can act in a security context broader than the plugin itself - typical of XSS where code runs with the privileges of the WordPress site/visitor session in the browser.

RemediationAI

No vendor-released patch version is confirmed from the available input data; the advisory only establishes that versions <= 1.5.3.5 are affected, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/page-builder-add/vulnerability/wordpress-landing-page-builder-plugin-1-5-3-5-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for a release newer than 1.5.3.5 and upgrade as soon as one is published. Until a fixed version is verified, compensating controls include deploying a Web Application Firewall (such as Patchstack's or a WAF with XSS rule sets) to filter script-injection payloads aimed at the plugin's endpoints, restricting or disabling the Landing Page Builder plugin on internet-facing sites if it is not actively needed (trade-off: any published landing pages built with it will stop functioning), and adding a restrictive Content-Security-Policy header to limit inline-script execution (trade-off: may break legitimate inline scripts and require tuning). Do not assume absence of a listed fix means none will be released.