EUVD-2026-47887
GHSA-x9fx-2h43-2prm
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H because only a logged-in WordPress administrator can be the victim; UI:R for mandatory admin click; S:C because XSS crosses plugin boundary into the admin browser session.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.
AnalysisAI
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting admin.php?page=post-status-notifier-lite. The plugin fails to escape the mod GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Technical ContextAI
The affected component is the Post Status Notifier Lite WordPress plugin (CPE: cpe:2.3:a:unknown:post_status_notifier_lite:*:*:*:*:*:*:*:*), a PHP-based WordPress plugin that manages post-status change email notifications. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin reads the mod URL parameter from user-controlled GET input and renders it directly into the HTML of the admin settings page without applying WordPress sanitization functions such as esc_attr() or esc_html(). This is a classic reflected (non-persistent) XSS pattern - the payload is never stored server-side, so the injected script only executes when the victim's browser loads the attacker-controlled URL. The CVSS Scope:Changed metric (S:C) is technically accurate: XSS in a WordPress admin page can affect resources beyond the plugin itself, including the WordPress session cookie, nonce tokens, and the ability to perform privileged admin actions through the victim's authenticated session.
RemediationAI
The primary remediation is to upgrade Post Status Notifier Lite to version 1.13.0 or later, which properly escapes the mod URL parameter before output. The patch is confirmed available per vendor advisory referenced at https://wpscan.com/vulnerability/b316e14a-4260-43c4-996c-345c7f9f7d74/. If immediate patching is blocked, the most effective compensating control is to restrict access to the WordPress admin area (/wp-admin/) by IP allowlist at the web server or WAF layer, which prevents an attacker from reaching the vulnerable endpoint even with a crafted URL - trade-off is operational friction for distributed admin teams. A WAF rule blocking script-injection patterns (angle brackets, javascript:, onerror=) in the mod query parameter on admin.php?page=post-status-notifier-lite can also mitigate the issue, though encoding bypass variants may circumvent naive rules. Additionally, security awareness for WordPress administrators to verify URL origins before clicking links from untrusted sources reduces the social-engineering dependency of this attack.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today