EUVD-2026-71853
GHSA-5h5f-jp5r-693p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS causes no server-side availability impact, so A:N replaces the provided A:L; all other metrics align with unauthenticated, victim-triggered, cross-origin script injection.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request.
AnalysisAI
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required on the attacker side (PR:N per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) captures the key dynamics: no attacker authentication is required, complexity is low, but victim interaction is mandatory (UI:R), which meaningfully caps real-world mass exploitation compared to server-side vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the IPGP Visitors Origin WordPress plugin to version 1.6 or later, which is confirmed by the vendor (WPScan advisory https://wpscan.com/vulnerability/8fbfb296-78d8-4f3b-ab21-7a5a4e0ea421/) to resolve the reflected XSS by properly sanitizing and escaping user input before output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations running the IPGP Visitors Origin plugin and identify instances below version 1.6. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today