EUVD-2026-36388
GHSA-8fxh-qpf8-gq8x
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
PR:H required for write access to notes; UI:R and S:C reflect cross-user XSS; A:N as XSS does not meaningfully affect availability.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Vulnerability Title
AnalysisAI
Stored cross-site scripting in the KeepInMind Dashboard Notes WordPress plugin (versions before 0.8.4.2) allows a high-privileged authenticated attacker to inject malicious script payloads into dashboard notes, which execute in the browsers of other users who view the affected notes. Reported by WPScan and corroborated by a publicly available exploit on Exploit-DB, the vulnerability carries a CVSS 3.1 score of 5.9 reflecting scope change (S:C) despite constrained prerequisites. No public exploit identified at time of analysis as active in-the-wild exploitation - EPSS stands at 0.03% (9th percentile), consistent with limited real-world targeting - and publicly available exploit code exists.
Technical ContextAI
The affected component is the KeepInMind Dashboard Notes plugin for WordPress, identified via CPE cpe:2.3:a:unknown:keepinmind_dashboard_notes:*:*:*:*:*:*:*:*. WordPress plugins that render user-supplied HTML or JavaScript in dashboard widgets are a well-established attack surface. The CVSS vector AV:N/AC:L/PR:H/UI:R/S:C is the canonical fingerprint for Stored XSS: an authenticated high-privileged user (PR:H) writes a malicious payload that persists server-side, a second user must view the poisoned content (UI:R), and execution crosses the boundary from the web application into the victim's browser security context (S:C). No CWE is formally assigned in the NVD record; CWE-79 (Improper Neutralization of Input During Web Page Generation) is the standard classification for this class, though this is inferred rather than vendor-confirmed.
RemediationAI
Update KeepInMind Dashboard Notes to version 0.8.4.2 or later; this is the vendor-released patch version confirmed by EUVD data. WordPress site administrators should apply the update via the plugin management dashboard or by downloading directly from the plugin repository. As a compensating control prior to patching, restrict the WordPress roles permitted to create or edit dashboard notes to only fully-trusted administrators, reducing the PR:H attack surface. Auditing existing note content for suspicious script tags is advisable if the plugin has been in use with multiple admin-level users. The WPScan advisory at https://wpscan.com/vulnerability/b5d549b7-17c8-417d-a86a-a7ae356a6eab/ and Exploit-DB entry at https://www.exploit-db.com/exploits/52614 provide additional technical context for incident response.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today