EUVD-2026-53901
GHSA-r27x-6vf8-x5gj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N/PR:N confirmed by unauthenticated network delivery; S:C reflects browser context escape; A:N because XSS does not directly impair availability of the plugin or service.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to adequately sanitize or encode attacker-controlled input before it is rendered in HTML responses. Thrive Architect is a commercial WordPress page builder plugin developed by Thrive Themes, identified by CPE cpe:2.3:a:thrive_themes_coupon:thrive_architect:*:*:*:*:*:*:*:*. Page builder plugins are particularly high-risk for XSS because they process complex user-supplied content (shortcodes, widgets, design parameters) and render it directly into page output, creating numerous potential injection points. The exact injection vector - whether reflected, stored, or DOM-based - is not specified in available data, but the PR:N metric confirms no authentication is required to introduce the payload. The S:C metric is consistent with browser-side script execution escaping the plugin's own output context.
RemediationAI
Update the Thrive Architect plugin to a version beyond 10.9.3.1 immediately; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/thrive-visual-editor/vulnerability/wordpress-thrive-architect-plugin-10-9-3-1-cross-site-scripting-xss-vulnerability should be consulted to confirm the exact patched release version, which was not independently confirmed in the available intelligence data. If an immediate upgrade is not possible, a compensating control is to temporarily deactivate the Thrive Architect plugin and use an alternative page builder - this eliminates the attack surface entirely but disrupts page editing capability. Deploying a WordPress Web Application Firewall (WAF) rule targeting XSS injection patterns in Thrive Architect request parameters can reduce exploitation probability but is not a substitute for patching. Additionally, enforcing strict Content Security Policy (CSP) headers that disallow inline script execution can limit the impact of successful XSS even if injection occurs, though this may break plugin functionality and requires testing. Patchstack's virtual patching feature provides a firewall rule for subscribers as an interim measure.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today