EUVD-2026-11965Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 6.5 reflects a medium-to-high severity with the vector AV:N/AC:L/PR:L/UI:R/S:C indicating network-accessible attack with low complexity, requiring low privileges (authenticated user), user interaction, and cross-site impact. While the CVSS score is moderate, several factors elevate real-world risk: (1) Authentication is required (PR:L) but many WordPress sites grant editor/contributor roles liberally, (2) The vulnerability is DOM-based and likely persistent, affecting all subsequent page loads until remediated, (3) The attack changes the security boundary (S:C), potentially affecting administrators viewing bulk edit results, and (4) WordPress plugin vulnerabilities have high exploitation rates due to automated scanning. However, the requirement for user interaction and low privilege level provides some friction compared to unauthenticated remote code execution. Without confirmed KEV status or public POC availability, this remains a lower-urgency patch but should still be prioritized for WordPress sites with untrusted contributor-level users. The automatable nature of WordPress vulnerability detection suggests rapid weaponization post-disclosure is likely. |
| Exploit ScenarioDerived | An authenticated user with editor-level privileges creates a bulk edit operation and injects a malicious JavaScript payload into one of the bulk edit fields (e.g., post title or metadata field). When an administrator accesses the bulk edit results page to review the changes, the unescaped DOM content renders the payload, executing arbitrary JavaScript in the administrator's browser session. This allows the attacker to steal session cookies, modify site content, create new admin accounts, or redirect the administrator to a credential-harvesting page, all without requiring additional user interaction beyond the initial bulk edit submission. Because the vulnerability is DOM-based rather than reflected, the payload persists in the page's rendered state, potentially affecting multiple users who view the bulk edit interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Brainstorm Force Astra Bulk Edit WordPress plugin through version 1.2.10, allowing authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. An attacker with low-privilege account access (e.g., contributor or editor role) can craft malicious input that, when processed by the bulk edit functionality, results in arbitrary JavaScript execution affecting site administrators and other users. The vulnerability requires user interaction (UI:R) but can affect multiple users across the site due to its stored/DOM-based nature, making it a persistent attack vector for privilege escalation or data exfiltration.
RemediationAI
Immediately upgrade the Astra Bulk Edit plugin to a patched version released after 1.2.10 via the WordPress admin dashboard (Plugins > Updates) or by downloading the latest version from the official WordPress plugin repository. Verify the upgrade completed successfully and review the plugin changelog to confirm XSS protections were implemented. As a temporary measure pending patch availability, site administrators should restrict bulk edit functionality to trusted administrator accounts only by using role management plugins or disabling bulk edit capabilities for lower-privilege users. Additionally, implement a Content Security Policy (CSP) header with script-src restrictions and enable WordPress security hardening plugins that provide input validation and output encoding protections. Monitor for any suspicious activity in audit logs correlating with bulk edit operations, as DOM-based XSS in administrative interfaces may indicate compromise of editor or contributor accounts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-based XSS. DOM-based XSS occurs when client-side JavaScript code processes user-controlled input unsafely, using methods like innerHTML, eval(), or similar DOM manipulation without proper sanitization or encoding. In the Astra Bulk Edit plugin (CPE: cpe:2.3:a:brainstorm_force:astra_bulk_edit), the bulk edit functionality likely accepts user input through form fields or AJAX requests and reflects this data directly into the DOM without adequate output encoding or Content Security Policy (CSP) protections. The vulnerability affects the plugin's ability to safely handle form inputs during batch editing operations, a common attack surface in administrative interfaces where multiple data fields are processed simultaneously.
Know when Astra Bulk Edit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.
Executive ViewAI
CVE-2026-32431 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
GitHub PoC
Exploit-DB