EUVD-2026-66885
GHSA-w97m-rc73-v4hm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Scope changed because injected script executes in admin browser (different security authority); availability impact lowered to Low since XSS does not directly cause service disruption.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high privilege users such as admin.
AnalysisAI
Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Injection requires no authentication - any unauthenticated user with network access to the WordPress site can submit the malicious payload (PR:N, AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects the significant impact possible if an administrator views the poisoned log entry, but the UI:R requirement is a meaningful friction point - exploitation is not fire-and-forget. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker identifies a WordPress site running the vulnerable plugin version and submits a crafted form entry containing a JavaScript payload (e.g., a cookie-stealing script) through any publicly accessible plugin-handled endpoint. The payload is stored in the activity log without sanitization. … |
| Remediation | Update the 12 Step Meeting List WordPress plugin to version 3.19.17 or later; this is confirmed as the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/27de9242-d60e-42e8-a3a5-e355bfc00393/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using the 12 Step Meeting List plugin and audit which versions are deployed; review activity logs for suspicious or encoded entries indicating injection attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today