What is the CVSS score of CVE-2026-57686?

CVE-2026-57686 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WowAddons are affected by CVE-2026-57686?

The WowAddons WordPress plugin (versions through 1.6.14) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript into end-user…

How to fix or mitigate CVE-2026-57686?

Within 24 hours: Inventory all WordPress installations to identify WowAddons plugin presence and confirm version status. Within 7 days: Deactivate or remove WowAddons version 1.6.14 and earlier; alternatively, implement WAF rules to sanitize malicious input if removal creates operational constraints. Within 30 days: Subscribe to vendor security advisories and prepare deployment procedures for the patch once released; conduct post-incident review of plugin governance processes.

WowAddons CVE-2026-57686

EUVD-2026-41295 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-98qg-mg4c-wh4m

WordPress XSS Wordpress Plugin Wowaddons Wpxpo

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network reflected XSS requiring victim interaction (UI:R) with browser-context scope change (S:C); confidentiality and integrity Low, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:26 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WowAddons <= 1.6.14 versions.

AnalysisAI

Reflected cross-site scripting in the WowAddons (Product Addons) WordPress plugin through version 1.6.14 lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) indicates no authentication is needed but the victim must be lured into interacting with a crafted request/link, and the scope-change flag reflects script execution crossing into the browser security context. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected component is the WowAddons plugin (vendor wpxpo, slug 'product-addons'), a WooCommerce/WordPress extension that adds custom product options and add-ons to storefronts, identified by CPE cpe:2.3:a:wpxpo:wowaddons:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected into an HTML response without adequate output encoding or input sanitization. Because the injection point is reachable without authentication, the untrusted data is echoed back on a publicly accessible endpoint, allowing HTML/JavaScript to be interpreted by the browser rather than treated as inert text.

RemediationAI

Upgrade WowAddons to the next release above 1.6.14 published by wpxpo; the provided data does not include an exact fixed version, so No vendor-released patch version is independently confirmed at time of analysis - consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/product-addons/vulnerability/wordpress-wowaddons-plugin-1-6-14-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org changelog to identify and apply the patched build. Until a confirmed fix is applied, place the vulnerable endpoints behind a Web Application Firewall (e.g., Patchstack or Wordfence virtual patching) with reflected-XSS rules to strip script payloads, and add a strict Content-Security-Policy header to constrain inline script execution (trade-off: CSP may break legitimate inline scripts and require tuning). If the add-on functionality is non-essential, deactivate the plugin as the most reliable compensating control, accepting loss of the product-add-on features it provides.