What is the CVSS score of CVE-2026-61982?

CVE-2026-61982 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of SiteGuard WP Plugin are affected by CVE-2026-61982?

The SiteGuard WP Plugin (versions ≤1.8.6) contains an unauthenticated cross-site scripting vulnerability that allows remote attackers to inject malicious scripts into WordPress site pages visited by…

How to fix or mitigate CVE-2026-61982?

Within 24 hours, identify all WordPress installations running SiteGuard WP Plugin version 1.8.6 or earlier and immediately disable or remove the plugin pending a security patch. Within 7 days, establish contact with the plugin vendor to confirm patch availability timeline and implement temporary Web Application Firewall (WAF) rules to detect and block JavaScript injection payloads targeting affected sites. Within 30 days, apply the vendor-released security patch to version 1.8.7 or later once available, or migrate to an alternative security plugin if the vendor does not release a timely fix, ensuring all WordPress sites running the vulnerable plugin are either patched or replaced.

SiteGuard WP Plugin CVE-2026-61982

EUVD-2026-53960 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-2pjv-rp2m-j233

WordPress XSS Wordpress Plugin Siteguard Wp Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-accessible injection with no privileges; user interaction required for execution; scope change to browser context; limited C/I/A impacts consistent with reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:24 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.

AnalysisAI

Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

SiteGuard WP Plugin, developed by JP-Secure (CPE: cpe:2.3:a:jp-secure:siteguard_wp_plugin), is a WordPress plugin that provides login protection, CAPTCHA enforcement, and other hardening features for WordPress installations. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data is reflected or stored in HTML output without sufficient encoding or sanitization. Because the plugin operates in a WordPress environment (PHP/HTML), unsanitized input rendered into plugin-generated pages becomes executable JavaScript in any victim's browser. The changed scope in the CVSS vector confirms that the impact crosses the boundary from the WordPress application context into the victim's browser context.

RemediationAI

The primary remediation is to update SiteGuard WP Plugin to a version released after 1.8.6 via the WordPress plugin dashboard or by downloading directly from the plugin repository. No exact fixed version number was confirmed in the available Patchstack advisory data - administrators should verify the current latest release version exceeds 1.8.6 before applying. The Patchstack advisory is available at https://patchstack.com/database/wordpress/plugin/siteguard/vulnerability/wordpress-siteguard-wp-plugin-plugin-1-8-6-cross-site-scripting-xss-vulnerability. As a compensating control while patching is pending, consider restricting access to the affected plugin pages to trusted IP ranges using server-level rules (e.g., nginx allow/deny or Apache mod_authz_host), which reduces unauthenticated attacker reach at the cost of limiting legitimate remote access. Additionally, deploying a web application firewall (WAF) rule targeting script injection patterns in plugin request parameters can reduce exploitation likelihood without service disruption.