EUVD-2026-57910
GHSA-7mm3-92v6-pmx6
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Author role (PR:H) required to plant payload; UI:R for victim to trigger; S:C reflects cross-user browser execution; A:N as stored XSS carries no direct availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
AnalysisAI
Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker holds an active, authenticated WordPress Author role account on the target site - this is confirmed by the CVSS PR:H metric and the CVE title's explicit 'Author' attribution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.9 Medium is plausible given the constrained attack path: the vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L requires an authenticated Author-role account and victim interaction before any payload fires. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has registered or compromised a WordPress Author account on a site running WP Data Access ≤ 5.5.79 crafts a data entry containing a JavaScript payload through the plugin's data management interface, which stores the script persistently. When a site administrator subsequently opens the affected view or manages the corresponding dataset, the stored script executes silently in the admin's browser, allowing the attacker to exfiltrate the admin's session cookie or perform privileged actions such as creating a backdoor administrator account. |
| Remediation | The primary remediation is to update the WP Data Access plugin to a version released after 5.5.79; all currently documented releases through 5.5.79 are confirmed vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Data Access
View allThe WP Data Access WordPress plugin before 5.0.0 does not properly sanitise and escape the backup_date parameter before
Unauthenticated SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.70) allows remote attackers to inj
The WP Data Access plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.3.7. R
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79)
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthent
Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmers B.V. Rated medium severity (CVSS 4.3), this vu
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today