What is the CVSS score of CVE-2026-6690?

CVE-2026-6690 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of LifePress are affected by CVE-2026-6690?

The LifePress WordPress plugin (versions ≤2.2.2) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts executable in administrator…

How to fix or mitigate CVE-2026-6690?

Within 24 hours: Identify all WordPress instances running LifePress plugin and document current versions via plugin management console or wp-cli. Within 7 days: If running LifePress ≤2.2.2, either (1) deactivate and remove the plugin entirely, or (2) restrict access to wp-admin and the plugin's settings pages to IP allowlists only. Within 30 days: Monitor vendor advisory channels for LifePress security updates; consider alternative plugins with active security maintenance if no patch is released within 60 days.

LifePress CVE-2026-6690

EUVD-2026-29406 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-gr8x-5jx5-8hqx

XSS WordPress

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:46 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

HIGH 7.2

DescriptionCVE.org

The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in all versions up to, and including, 2.2.2. This is due to the wp_ajax_nopriv_lp_update_mds action being registered without nonce verification or capability checks, combined with insufficient input sanitization and output escaping when the series name is rendered in the admin settings page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in LifePress WordPress plugin allows unauthenticated remote attackers to inject malicious scripts that execute in administrator contexts when viewing the plugin's settings page. The vulnerability affects all versions through 2.2.2 and stems from a publicly-accessible AJAX endpoint (lp_update_mds) that lacks both nonce verification and capability checks, combined with improper input sanitization of the 'n' parameter. The CVSS score of 7.2 reflects network-based exploitation requiring no authentication or user interaction, with changed scope enabling cross-context attacks. EPSS and KEV data not available; exploitation probability depends on attacker knowledge of the specific AJAX action endpoint.

Technical ContextAI

This vulnerability exists in the LifePress plugin (CPE: cpe:2.3:a:ashanjay:lifepress), a WordPress extension for activity tracking and metrics. The flaw is a classic Stored Cross-Site Scripting (CWE-79) vulnerability arising from three compounding security failures in the AJAX handler architecture. First, the plugin registers wp_ajax_nopriv_lp_update_mds, which processes requests from non-authenticated users without requiring WordPress nonces for CSRF protection. Second, it performs no capability checks to verify the requester has administrative privileges. Third, the 'n' parameter (series name) passed to this endpoint undergoes insufficient sanitization before being stored and later rendered in the admin settings interface without proper output escaping. WordPress AJAX actions with the nopriv_ prefix are intentionally accessible to unauthenticated users, making proper input validation and capability checks critical-both of which are absent here. The referenced source code shows the AJAX handler at class-admin-ajax.php:110 and the metrics rendering at class-metrics.php:355, confirming the data flow from unauthenticated input to privileged output context.

RemediationAI

Primary remediation requires upgrading LifePress to a patched version that addresses the missing nonce verification, capability checks, and input sanitization issues in the lp_update_mds AJAX handler-however, no specific patched version number is confirmed in available data at time of analysis. Monitor the WordPress plugin repository and Wordfence advisory for patch release announcements. Until a vendor patch is available, implement these compensating controls: (1) Deactivate and remove the LifePress plugin if the metrics functionality is non-critical to operations, eliminating the attack surface entirely with no functional trade-off if analytics are available through alternative plugins. (2) Deploy a Web Application Firewall (WAF) rule blocking POST requests to /wp-admin/admin-ajax.php containing action=lp_update_mds from unauthenticated sources, though this may break legitimate plugin functionality if the AJAX action serves any user-facing features. (3) Implement Content Security Policy headers restricting script execution to trusted sources, which mitigates XSS impact but does not prevent payload injection and may require CSP tuning to avoid breaking legitimate admin functionality. (4) Apply enhanced monitoring for unexpected database modifications to tables storing LifePress metrics data. None of these workarounds fully eliminate the vulnerability-WAF blocking is the most effective temporary control but requires testing to confirm it doesn't disrupt required plugin operations.