What is the CVSS score of CVE-2026-57357?

CVE-2026-57357 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Search Atlas SEO are affected by CVE-2026-57357?

The Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier) enables attackers to compromise user sessions and forge administrative actions on any affected WordPress site without requiring…

How to fix or mitigate CVE-2026-57357?

24 hours: Disable and remove the Search Atlas SEO plugin (metasync slug, versions 2.6.6 and earlier) from all WordPress installations; audit for presence across the organization. 7 days: Review server and WordPress audit logs for indicators of script injection attempts; document any suspicious activity and remediation actions taken. 30 days: Subscribe to vendor security channels for patched version availability; evaluate and transition to alternative SEO solutions if patch remains unavailable.

Search Atlas SEO CVE-2026-57357

EUVD-2026-41356 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-2jwq-r643-85mf

WordPress XSS Wordpress Plugin Search Atlas Seo

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network-reachable reflected XSS (PR:N, AV:N) requiring a victim click (UI:R); script runs cross-context in the browser (S:C) with low confidentiality/integrity impact and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:16 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Search Atlas SEO <= 2.6.6 versions.

AnalysisAI

Reflected cross-site scripting in the Search Atlas SEO WordPress plugin (versions 2.6.6 and earlier, distributed under the 'metasync' slug) lets an unauthenticated attacker inject script that executes in a victim's browser session when they follow a crafted link. Rated CVSS 7.1 with an elevated score due to a scope change, the flaw affects any WordPress site running the vulnerable plugin and can lead to session hijacking, admin action forgery, or redirection. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Search Atlas SEO plugin for WordPress (CPE cpe:2.3:a:search_atlas_group:search_atlas_seo), a plugin that surfaces SEO analytics and content optimization inside the WordPress admin/front-end and whose repository slug is 'metasync'. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected variant: attacker-controlled request data (e.g. a URL parameter) is echoed back into an HTML response without proper output encoding or input sanitization, so the browser parses injected markup as executable script. Because the plugin runs within the WordPress PHP request pipeline, the reflected payload executes in the security context of the targeted WordPress site's origin.

RemediationAI

Upgrade the Search Atlas SEO (metasync) plugin to a release later than 2.6.6 once available from the vendor; an exact fixed version was not provided in this data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/metasync/vulnerability/wordpress-search-atlas-seo-plugin-2-6-6-reflected-cross-site-scripting-xss-vulnerability) for the patched version before deploying. If a patched release is not yet installable, deploy a Web Application Firewall rule (Patchstack or equivalent) to filter reflected XSS payloads on the plugin's request parameters, which adds latency and can occasionally block legitimate query strings; alternatively, deactivate and remove the plugin until fixed, which removes SEO functionality but eliminates the exposure. Reinforce browser-side defenses by enforcing a strict Content-Security-Policy that disallows inline script, noting this can break legitimate inline scripts on the site and requires testing.