What is the CVSS score of CVE-2026-6858?

CVE-2026-6858 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Is there a public PoC exploit available for CVE-2026-6858?

Yes, a public proof-of-concept exploit is available for CVE-2026-6858. Prioritise patching immediately.

Is there a patch available for CVE-2026-6858?

Yes, a patch is available for CVE-2026-6858. Update the affected software to the latest version immediately.

Transbank Webpay CVE-2026-6858

EUVD-2026-38213 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-22 WPScan

GHSA-4c54-mjrj-jwj4

WordPress XSS Transbank Webpay

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 22, 2026 - 07:46 EUVD

CVE Published

Jun 22, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

Articles & Coverage 2

News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 23, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity, All With POC Jun 22, 2026

Analysis

The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against logged in administrator

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-6858 vulnerability details – vuln.today

Back