EUVD-2026-71873
GHSA-gpfv-rv3h-8jx7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
S:C reflects stored XSS executing in admin/visitor browser context outside the plugin; A:N because XSS does not directly impair availability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
AnalysisAI
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with at minimum Subscriber-level privileges on the target site - obtainable via public registration if the site permits it, or through credential reuse or purchase. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 score (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) accurately reflects low-privilege network exploitation with victim interaction required, though the A:H component appears overstated - stored XSS does not inherently disrupt availability, making C:H and I:H (achievable via admin session hijacking) the realistic impact ceiling. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the JCH Optimize plugin to version 6.0.1 or later immediately via the WordPress plugin dashboard (Plugins > Installed Plugins > Update) or by downloading directly from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all WordPress installations and determine which use JCH Optimize plugin with version prior to 6.0.1; restrict Subscriber account creation if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jch Optimize
View allBroken Access Control vulnerability in Samuel Marshall JCH Optimize.0.0. Rated high severity (CVSS 8.8), this vulnerabil
Path traversal in the JCH Optimize WordPress plugin (versions before 5.0.1) permits authenticated administrators - inclu
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today