What is the CVSS score of CVE-2026-7660?

CVE-2026-7660 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Easy Updates Manager CVE-2026-7660

EUVD-2026-32737 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Wordfence

GHSA-4h59-2qw2-mv4q

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:53 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

MEDIUM 6.1

DescriptionCVE.org

The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the Easy Updates Manager WordPress plugin (versions ≤ 9.0.20) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized 'paged' parameter in the pagination() function of MPSUM_List_Table.php. Successful exploitation requires social engineering a logged-in WordPress administrator into clicking a crafted URL, after which the injected script executes in the admin's browser under the site's origin - enabling session hijacking, unauthorized admin actions, or credential theft. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The vulnerability resides in the pagination() function within the MPSUM_List_Table class (includes/MPSUM_List_Table.php, line 800) and also affects MPSUM_Plugins_List_Table.php (line 55) of the 'stops-core-theme-and-plugin-updates' WordPress plugin - the package slug for Easy Updates Manager by davidanderson (CPE: cpe:2.3:a:davidanderson:easy_updates_manager:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the 'paged' GET parameter is incorporated into paginated list table output without adequate sanitization (e.g., absint/intval) or escaping (e.g., esc_attr/esc_html) before being written into the HTML DOM. WordPress plugin list tables commonly accept 'paged' as a query argument to navigate update queues; because this plugin manages core, theme, and plugin update controls it is frequently active on sites with elevated admin oversight requirements, making administrator-targeting XSS payloads particularly impactful. The CVSS Scope:Changed (S:C) reflects that the injected script executes outside the vulnerable component's trust boundary - in the victim's browser session - consistent with stored-or-reflected XSS achieving cross-origin impact.

RemediationAI

Upgrade Easy Updates Manager to version 9.0.21 or later immediately - the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.20&new_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.21) confirms the fix was introduced in 9.0.21 via sanitization corrections in MPSUM_List_Table.php. The upgrade can be applied through the WordPress admin dashboard (Plugins → Updates) or via WP-CLI: 'wp plugin update stops-core-theme-and-plugin-updates'. If an immediate upgrade is not possible, a compensating control is to restrict access to the WordPress admin area (/wp-admin/) to trusted IP ranges via server-level rules (nginx location block or Apache .htaccess) - this prevents attackers from being able to deliver a URL that resolves to the vulnerable endpoint. Note that IP restriction may interfere with remote administrator access and should account for dynamic IPs. Additionally, a Web Application Firewall (WAF) with WordPress XSS rules (e.g., Wordfence's own firewall) can detect and block injection attempts in query parameters, though WAF rules are not a substitute for patching.