What is the CVSS score of CVE-2026-57351?

CVE-2026-57351 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of HandL UTM Grabber are affected by CVE-2026-57351?

The HandL UTM Grabber WordPress plugin (versions 2.9.2 and earlier) contains a high-severity stored/reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject…

How to fix or mitigate CVE-2026-57351?

24 hours: Inventory all WordPress installations running HandL UTM Grabber version 2.9.2 or earlier and immediately deactivate the plugin. 7 days: Evaluate alternative UTM tracking solutions and establish communication with the vendor regarding patch timeline and availability. 30 days: Deploy a replacement plugin with comparable functionality following security review, or implement mandatory Content Security Policy (CSP) headers and input validation controls if continued use is operationally required pending vendor patch release.

HandL UTM Grabber CVE-2026-57351

EUVD-2026-41350 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-fjv9-x6j5-5cgw

WordPress XSS Wordpress Plugin Handl Utm Grabber

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable unsanitized UTM input (AV:N/AC:L/PR:N) requires victim interaction (UI:R); reflected/stored script crosses into other sessions (S:C) with limited C/I/A impact typical of XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:15 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions.

AnalysisAI

Stored/reflected cross-site scripting in the HandL UTM Grabber WordPress plugin (versions 2.9.2 and earlier) allows remote unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser after user interaction, per PR:N/UI:R in the CVSS vector. The scope-change flag (S:C) indicates injected script can affect resources beyond the vulnerable component, such as authenticated admin sessions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

HandL UTM Grabber is a WordPress plugin (CPE cpe:2.3:a:haktan_suren:handl_utm_grabber) that captures UTM campaign tracking parameters from inbound URLs and stores them for use in forms, cookies, and analytics. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): attacker-controlled UTM values are reflected or stored without proper output encoding or input sanitization, allowing HTML/JavaScript to be interpreted by the browser. Because the plugin's core function is ingesting URL query parameters, these untrusted inputs flow directly into rendered pages, making them a natural XSS sink.

RemediationAI

No vendor-released patch version is identified in the available data - the input specifies affected versions <= 2.9.2 but does not name a fixed release; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/handl-utm-grabber/vulnerability/wordpress-handl-utm-grabber-plugin-2-9-2-cross-site-scripting-xss-vulnerability?_s_id=cve) for an updated version and upgrade as soon as one is published. Until then, apply compensating controls: deploy a WAF or WordPress security plugin (e.g. Patchstack, Wordfence) with virtual patching rules to filter script payloads in UTM query parameters (utm_source, utm_medium, utm_campaign, etc.); add a restrictive Content-Security-Policy header to limit inline script execution, noting this may break legitimate inline scripts and require tuning; and if the UTM-grabbing feature is non-essential, deactivate the plugin entirely to eliminate exposure at the cost of losing campaign tracking.