What is the CVSS score of CVE-2026-6800?

CVE-2026-6800 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

FastBots WordPress Plugin CVE-2026-6800

EUVD-2026-29443 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-72fr-4m7q-jfm7

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 10:30 vuln.today

CVE Published

May 12, 2026 - 09:29 nvd

MEDIUM 4.4

DescriptionCVE.org

The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in FastBots plugin for WordPress up to version 1.0.12 allows authenticated administrators to inject arbitrary JavaScript into admin settings that executes when any user accesses affected pages. The vulnerability requires high-privilege administrator access and affects only multi-site WordPress installations or single-site installations with the unfiltered_html capability disabled. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) in the FastBots plugin's settings-page.php file, which fails to properly sanitize user input and escape output in admin settings. The affected plugin (CPE:a:fastbots:fastbots:*:*:*:*:*:*:*:*) is a WordPress plugin providing AI chatbot functionality. The flaw allows stored XSS payloads to persist in the WordPress database when settings are saved without proper sanitization, then execute in the browsers of users who visit pages where these settings are rendered. WordPress's unfiltered_html capability normally allows administrators to use arbitrary HTML/JavaScript; this vulnerability affects installations where that capability is intentionally restricted or in multi-site setups where such restrictions are enforced.

RemediationAI

Update the FastBots plugin to version 1.0.13 or later, which should include proper input sanitization and output escaping in the settings-page.php file. Administrators should navigate to WordPress Plugins dashboard, locate FastBots, and apply the available update. As an interim workaround for multi-site installations or those with unfiltered_html restrictions, limit the assign_plugins and manage_options capabilities for administrator roles to trusted users only, reducing the pool of accounts capable of exploiting this vulnerability. Additionally, review the FastBots plugin settings page in WordPress admin and verify that no suspicious JavaScript or HTML has been injected into saved settings; if found, remove malicious content and update to the patched version. Monitor WordPress user access logs for unauthorized admin logins or settings modifications. This is not a critical vulnerability requiring immediate action in standard single-site WordPress installations but should be addressed promptly in multi-site networks.