EUVD-2026-75967
GHSA-r7gc-58c8-xh3j
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor access is PR:L not PR:H; stored XSS targeting admin sessions changes scope (S:C); no availability impact from XSS itself.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.
AnalysisAI
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account with contributor-level access or higher; subscriber accounts cannot create posts and cannot trigger this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 6.8 with a PR:H vector likely underrepresents the actual attack surface: WordPress contributors are conventionally low-privilege users (PR:L is more accurate), meaning the privilege bar to exploitation is lower than the official vector implies. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the AI Builder WordPress plugin to version 2.7.8 or later, which contains the vendor-released patch eliminating the unsanitized JavaScript output; this fix is available through the WordPress plugin repository and referenced at https://wpscan.com/vulnerability/d81ebdaa-4a06-48df-a471-c11ea7dc62f8/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today