What is the CVSS score of CVE-2026-7437?

CVE-2026-7437 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

AzonPost WordPress Plugin CVE-2026-7437

EUVD-2026-29414 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-j6jp-qv9p-ghvc

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The AzonPost plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the editpos_hidden parameter in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in AzonPost WordPress plugin versions up to 1.3 allows unauthenticated attackers to inject arbitrary JavaScript via the editpos_hidden parameter, executing in the browsers of administrators who click malicious links. The vulnerability stems from insufficient input sanitization and output escaping, requiring user interaction but affecting all versions of the plugin without requiring authentication or special configuration.

Technical ContextAI

AzonPost is a WordPress plugin that processes campaign-related parameters through the editpos_hidden field. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically reflected XSS where user-supplied input from the editpos_hidden parameter is output directly into HTML without proper escaping. The plugin fails to sanitize input before rendering it in responses, allowing attackers to craft URLs containing JavaScript payloads. WordPress plugins are executed in the context of the WordPress admin and public-facing pages, meaning injected scripts execute with the privileges of the user who visits the malicious link. The affected CPE (cpe:2.3:a:moch-a:azonpost:*:*:*:*:*:*:*:*) indicates all versions are potentially vulnerable through version 1.3.

RemediationAI

Update the AzonPost plugin to a version newer than 1.3 if available from the plugin repository; check the WordPress plugin directory or the plugin author's site for patched releases. If no patched version is available, disable and deactivate the AzonPost plugin entirely until a fix is released. As an interim mitigation, restrict administrative access to WordPress from untrusted networks using Web Application Firewall (WAF) rules to block requests containing the editpos_hidden parameter with suspicious encoding or script tags, though this is not a substitute for patching. WordPress administrators should avoid clicking links from untrusted sources that reference their WordPress admin panel, and security teams should monitor for campaign activity using parameter injection techniques if this plugin must remain active pending a patch. Reference the Wordfence vulnerability page at https://www.wordfence.com/threat-intel/vulnerabilities/id/4b32cfa8-6e10-4f09-859e-216c94a6560c?source=cve for additional details and any patch announcements.