EUVD-2026-53889
GHSA-8w42-33f6-xj98
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable, no privileges needed, user interaction required for reflected XSS; scope changed as script executes in browser; availability impact assessed as None since XSS does not typically disrupt service.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
AnalysisAI
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires no authentication against the WordPress installation - the vulnerable parameter is accessible to unauthenticated network requests per the PR:N CVSS metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a reflected XSS that is network-reachable without authentication and requires no special attack conditions, but does require a victim to interact with a crafted URL. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running WP Data Access 5.5.79 or earlier and crafts a URL that passes a malicious JavaScript payload through an unsanitized plugin parameter. The attacker delivers this URL to a WordPress administrator via phishing email or social media; when the administrator clicks the link while authenticated to the WordPress dashboard, the injected script executes in their browser, harvesting session cookies or WordPress nonces and transmitting them to an attacker-controlled server, enabling full administrative takeover of the site. … |
| Remediation | Upgrade WP Data Access to a version greater than 5.5.79 as the primary remediation step; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-data-access/vulnerability/wordpress-wp-data-access-plugin-5-5-79-cross-site-scripting-xss-vulnerability for the confirmed fixed release once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations for WP Data Access plugin and identify any instances running version 5.5.79 or earlier; if business-critical, immediately disable the plugin pending patch or workaround. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Data Access
View allThe WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inj
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. R
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by use
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthent
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today