EUVD-2026-64831
GHSA-phx4-j4pm-h7pj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network delivery with no auth required; UI:R for admin interaction; S:C and L impacts reflect browser-context JavaScript execution affecting admin session.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.
AnalysisAI
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the WPComplete plugin installed and active in a version at or below 2.9.5.6. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a remotely exploitable, low-complexity flaw requiring no authentication, but dependent on a privileged user interacting with attacker-controlled content (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WPComplete to a version above 2.9.5.6 as soon as one is released by Liquid Web / StellarWP; check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-6-cross-site-scripting-xss-vulnerability for the patched release version, which is not independently confirmed in the current intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for WPComplete plugin presence and identify instances running version 2.9.5.6 or earlier; assess criticality based on site sensitivity and exposure of administrative users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today