EUVD-2026-69929
GHSA-j962-73j3-5jjg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-reachable reflected XSS with no auth required; UI:R for victim click; S:C for browser-context escape; A:N as XSS does not typically cause availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.
AnalysisAI
Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no authentication - the CVSS vector confirms PR:N, making this reachable by any remote unauthenticated attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a reflected XSS pattern: network-reachable, low complexity, no authentication, but requiring victim interaction (UI:R) to trigger - meaning the attacker must socially engineer a target into clicking a crafted link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the TrustedSite plugin to the version confirmed as patched by Patchstack via the advisory at https://patchstack.com/database/wordpress/plugin/trustedsite/vulnerability/wordpress-trustedsite-plugin-1-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your WordPress deployments to identify any installations of the TrustedSite plugin and determine the installed version; if version 1.2.5 or earlier is found, immediately disable and deactivate the plugin to eliminate the attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today