EUVD-2026-89834
GHSA-x2g2-rx64-q32h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload
-
DeliveryDeliver crafted link/input to victim
-
ExploitVictim's browser processes plugin response
-
ExecutionInjected script executes in site origin
-
ImpactSteal session or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the WordPress Persistent Login plugin (by author lukeseager) at versions 3.1.3 and earlier. Per the CVSS vector, exploitation is remote and unauthenticated (AV:N/PR:N) but REQUIRES victim user interaction (UI:R) - the attacker must lure a user to click a crafted link or load attacker-influenced content that reaches the vulnerable sink. The limiting factors are: the plugin must be installed and active on the target WordPress site; a victim must interact with the malicious payload; and impact is confined to actions executable within the victim's browser session (C:L/I:L/A:L). The exact triggering parameter is not detailed in the provided advisory data. |
| Impact | The CVSS 3.1 base score of 7.1 (High) reflects an unauthenticated, network-exploitable XSS (AV:N/AC:L/PR:N) requiring user interaction (UI:R) with a scope change (S:C, script executing in the victim's browser context beyond the vulnerable component) and low impact across confidentiality, integrity and availability (C:L/I:L/A:L). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. In practice this is a typical stored/reflected WordPress plugin XSS: real but not an emergency. The 7.1 score is driven largely by the S:C scope change and PR:N rather than by severe technical impact - XSS damage is bounded by what the victim's session permits. This is a moderate-priority patching item rather than a mass-exploitation threat, though the unauthenticated vector means it deserves prompt patching on internet-facing sites. Note the reference is a Patchstack database entry only; the exact XSS variant (reflected vs stored) and injection sink are not specified in the provided data. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL or input targeting the WordPress Persistent Login plugin (<= 3.1.3) and lures a site visitor or logged-in user to trigger it (UI:R). The injected JavaScript executes in the victim's browser under the site's origin, enabling session/cookie theft, redirection, or actions on the victim's behalf. No authentication is required to deliver the payload (PR:N), but no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
RemediationAI
No vendor-released patch was identified at time of analysis for CVE-2026-94081, so the most reliable mitigation is to deactivate and remove the WordPress Persistent Login plugin from any site that does not strictly need persistent-login functionality (trade-off: users lose the 'remember me' behaviour and must re-authenticate more often). If the plugin must stay, check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-persistent-login/vulnerability/wordpress-wordpress-persistent-login-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve) regularly and upgrade the moment a fixed release above 3.1.3 is published, and in the interim restrict the plugin's exposed endpoints to trusted traffic where feasible, deploy WAF/virtual-patching rules that filter XSS payloads targeting the plugin's request parameters (trade-off: encoded or obfuscated payloads can bypass signature rules), and add a Content-Security-Policy that forbids inline/untrusted script execution (trade-off: a strict CSP can break other theme or plugin scripts and needs testing). Because exploitation requires the victim to interact with attacker-crafted content, also reinforce user guidance not to follow untrusted links while logged in and review logs for suspicious requests to the plugin's endpoints, accepting that these are compensating controls, not fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (improper neutralization of input during web page generation, i.e. cross-site scripting) in the WordPress Persistent Login plugin, a PHP-based WordPress extension that keeps users signed in via persistent login cookies. Root cause is that a value derived from request input reaches an HTML output context without adequate encoding or escaping, so attacker-supplied markup is reflected/rendered in the victim's authenticated page context. Because the CVSS vector carries S:C (scope change) and UI:R, the injected script executes in the victim's browser context outside the vulnerable component's own security scope, but only after a user is enticed into triggering the crafted request or loading the tainted page. Affected artifacts are captured by CPE cpe:2.3:a:lukeseager:wordpress_persistent_login:*:*:*:*:*:*:*:*, i.e. the plugin is vulnerable across its version history up to and including 3.1.3. The likely real-world consequence for a WordPress site is script execution in the context of a logged-in (possibly administrative) user, enabling session/CSRF-style actions within that user's privileges, although the documented impact is limited to Low across C/I/A. The precise injection point (parameter or hook) is not enumerated in the supplied advisory data.
Know when Wordpress Persistent Login gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-delivered XSS (AV:N/PR:N) needing victim interaction (UI:R); script runs cross-context (S:C) with bounded low CIA impact typical of XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Executive ViewAI
The WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier contains a high-severity unauthenticated cross-site scripting vulnerability (CVE-2026-94081) that requires victim interaction and can execute script in an affected user's browser session. No public exploit identified at time of analysis, no confirmed active exploitation is indicated (no CISA KEV listing), and no vendor-released patch identified at time of analysis, so the immediate business risk is primarily to WordPress site users and administrators who may be targeted through phishing or malicious content. Leadership should prioritize discovery and mitigation of affected WordPress instances while monitoring for exploitation attempts.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing the Persistent Login plugin at versions 3.1.3 and earlier, virtual patching via WAF, restricting administrative access, enforcing multi-factor authentication, and user awareness to avoid phishing or malicious content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB