EUVD-2026-43475Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS needs no attacker privileges (PR:N) but requires a victim click (UI:R); script runs in a different context (S:C) with limited CIA impact, giving Low impacts.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Security Headers gd-security-headers allows Reflected XSS.This issue affects GD Security Headers: from n/a through <= 1.8.
AnalysisAI
Reflected cross-site scripting in the GD Security Headers WordPress plugin (by Milan Petrovic, versions up to and including 1.8) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. The flaw stems from improper input neutralization during web page generation (CWE-79) and, per the CVSS scope-change metric, can affect resources beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires victim user interaction (UI:R): a target must click or load an attacker-crafted link/request that carries the XSS payload to a GD Security Headers endpoint on a WordPress site running version 1.8 or earlier with the plugin active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L: network-reachable, low complexity, no privileges, but crucially requires user interaction (UI:R) and yields only Low impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL containing a malicious script payload in a parameter processed by the GD Security Headers plugin and delivers it to a logged-in WordPress administrator via email, chat, or a malicious page. When the admin clicks the link, the unsanitized input is reflected into the page and the script executes in their session, allowing actions such as stealing session tokens or performing admin actions on their behalf. … |
| Remediation | No vendor-released patch version is identified at time of analysis, so treat all versions through 1.8 as vulnerable and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gd-security-headers/vulnerability/wordpress-gd-security-headers-plugin-1-8-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org page for a release above 1.8, applying it as soon as it is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all WordPress installations to identify those running GD Security Headers plugin versions 1.8 or earlier, including both production and development environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gd Security Headers
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today