EUVD-2026-60932
GHSA-vc53-q699-w36f
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS does not credibly cause availability impact, so A:N; all other metrics align with the unauthenticated, scope-changed injection confirmed by CVSS and description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
AnalysisAI
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Templately plugin installed and active at version 3.7.1 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score reflects meaningful real-world risk: the attack vector is network (AV:N), complexity is low (AC:L), no privileges are required (PR:N), but victim interaction is necessary (UI:R), moderately limiting opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - update the Templately plugin beyond version 3.7.1 via the WordPress plugin update mechanism or by downloading directly from the WPDeveloper repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct immediate inventory of all WordPress installations running Templately version 3.7.1 or earlier and classify by business criticality; enable detailed access and error logging on affected systems to establish a baseline for detecting exploitation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Templately
View allMissing Authorization vulnerability in WPDeveloper Templately templately.1.2. Rated medium severity (CVSS 6.5), this vul
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, all
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any rem
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today