EUVD-2026-64830
GHSA-fw88-p55f-mvpj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-accessible XSS with scope change; availability set to N because XSS does not meaningfully disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.
AnalysisAI
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the 12 Step Meeting List plugin installed, activated, and running version 3.19.16 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-accessible, low-complexity attack requiring no privileges but dependent on victim interaction - the hallmark of reflected or stored XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Site administrators should update the 12 Step Meeting List plugin to a version beyond 3.19.16 as soon as a patched release is confirmed - no specific patched version number has been independently verified from the available data, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/12-step-meeting-list/vulnerability/wordpress-12-step-meeting-list-plugin-3-19-16-cross-site-scripting-xss-vulnerability should be monitored for patch status. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using 12 Step Meeting List plugin versions 3.19.16 or earlier and disable or uninstall the plugin immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in 12 Step Meeting List
View allImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12
Missing Authorization vulnerability in Code for Recovery 12 Step Meeting List.14.28. Rated high severity (CVSS 8.8), thi
Broken access control in AA Web Servant 12 Step Meeting List plugin version 3.19.9 and earlier allows authenticated user
The AA Web Servant 12 Step Meeting List WordPress plugin through version 3.19.9 exposes sensitive information in sent da
Server-Side Request Forgery (SSRF) vulnerability in Code for Recovery 12 Step Meeting List.14.24. Rated medium severity
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today