What is the CVSS score of CVE-2026-6858?

CVE-2026-6858 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Transbank Webpay are affected by CVE-2026-6858?

The Transbank Webpay WordPress plugin contains a vulnerability for which publicly available exploit code exists, allowing unauthenticated attackers to inject code that executes in administrator…. A patch is available.

Is there a public PoC exploit available for CVE-2026-6858?

Yes, a public proof-of-concept exploit is available for CVE-2026-6858. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-6858?

Within 24 hours, identify all WordPress installations using the Transbank Webpay plugin and document current versions. Within 7 days, upgrade all affected instances to version 1.14.0 or later. Within 30 days, conduct a security audit of affected WordPress sites for signs of exploitation or unauthorized administrative access, and review firewall and intrusion detection logs for attempted XSS payloads.

Transbank Webpay CVE-2026-6858

EUVD-2026-38213 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 WPScan

GHSA-4c54-mjrj-jwj4

XSS WordPress Transbank Webpay

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated injection over the network (PR:N, AV:N) but payload only fires when an admin views logs (UI:R), and the script crossing into the admin browser is a scope change (S:C) with Low C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 21:13 vuln.today

Patch available

Jun 22, 2026 - 07:46 EUVD

CVE Published

Jun 22, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 22, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

Articles & Coverage 2

News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 23, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 22, 2026

AnalysisAI

Stored cross-site scripting in the Transbank Webpay WordPress plugin before 1.14.0 lets unauthenticated visitors inject malicious script into plugin log entries that execute in the browser of any administrator who later views the logs. Because injection requires no authentication and the payload runs in a privileged admin session, it can be used to hijack the WordPress backend; publicly available exploit code exists and a public write-up chains the flaw toward remote code execution. EPSS is low (0.16%, 6th percentile) and CISA SSVC records no observed exploitation, so real-world targeting appears limited despite the high CVSS of 7.1.

Technical ContextAI

Transbank Webpay is a WordPress e-commerce plugin that integrates the Chilean Transbank Webpay payment gateway into WooCommerce/WordPress stores, handling payment transactions and writing diagnostic log entries. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin records attacker-influenced data into its logs but fails to sanitize on input or escape on output when those logs are rendered in the WordPress admin dashboard, so HTML/JavaScript in the stored value is interpreted by the administrator's browser. This is a classic stored (persistent) XSS where the untrusted sink is the admin log-viewer page. The CPE is cpe:2.3:a:unknown:transbank_webpay:*:*:*:* covering all versions prior to 1.14.0 (EUVD: Transbank Webpay 0 <1.14.0).

RemediationAI

Vendor-released patch: upgrade the Transbank Webpay plugin to version 1.14.0 or later, which adds sanitization and output escaping for logged data; this is the primary and complete fix. Review the WPScan advisory (https://wpscan.com/vulnerability/81035d75-81a5-486a-a9fb-b0d1e0befe3c/) and update through the WordPress plugin manager. Until patched, compensating controls include restricting who can access the plugin's log-viewer page and avoiding opening those logs in a browser (view them via the raw file over SSH instead, which trades convenience for safety), and deploying a WAF rule or WordPress security plugin to strip script tags from inputs reaching the payment/log flow (which may cause false positives on legitimate order data). Because the injection point is reachable by unauthenticated users, temporarily disabling the plugin on non-transacting stores eliminates exposure at the cost of losing Webpay payment functionality.