EUVD-2026-70580
GHSA-prwr-9w25-qq58
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Standard reflected/stored XSS: network-reachable, no auth, victim interaction required, scope change to browser; A:N because XSS does not cause server-side availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.
AnalysisAI
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the Breadcrumb NavXT plugin installed and active at version 7.5.1 or earlier, and that a victim user (any role, including unauthenticated visitors or administrators) visits a page or URL that renders the vulnerable breadcrumb output containing attacker-controlled input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a realistic but user-interaction-dependent risk: an attacker cannot exploit this silently without a victim visiting a crafted URL or page. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Breadcrumb NavXT to a version released after 7.5.1 via the WordPress plugin dashboard or by downloading from the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress installations for Breadcrumb NavXT plugin version ≤ 7.5.1 and immediately disable or remove the plugin from affected sites. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today