What is the CVSS score of EUVD-2026-14000?

EUVD-2026-14000 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by EUVD-2026-14000?

Organizations using the search-pattern tester page in all should be aware of moderate risk from CVE-2026-2277, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

How to fix or mitigate EUVD-2026-14000?

Within 30 days: Identify affected systems running the search-pattern tester page in all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14000

| CVE-2026-2277 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-4r2x-xpjr-7cvv

GHSA-r773-4wcf-9vm6

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14000

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.1

DescriptionCVE.org

The rexCrawler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' and 'regex' parameters in the search-pattern tester page in all versions up to, and including, 1.0.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

The rexCrawler WordPress plugin contains a Reflected Cross-Site Scripting (XSS) vulnerability in the search-pattern tester page that allows unauthenticated attackers to inject arbitrary web scripts via inadequately sanitized 'url' and 'regex' parameters. Affected versions are up to and including 1.0.15 (CPE: cpe:2.3:a:larsdrasmussen:rexcrawler:*:*:*:*:*:*:*:*), with exploitation requiring social engineering to trick administrators into clicking a malicious link. This vulnerability is limited to WordPress multisite installations or sites where the unfiltered_html capability has been disabled, and carries a CVSS v3.1 score of 6.1 with an AV:N/AC:L/PR:N/UI:R/S:C profile indicating network-based exploitation with user interaction required.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw where user-supplied input from HTTP parameters is rendered in HTML responses without proper sanitization or output encoding. The rexCrawler plugin, developed by larsdrasmussen for WordPress, implements a regex testing utility (admin_regex_test.php at lines 25 and 29 per plugin repository evidence) that directly echoes the 'url' and 'regex' query parameters into the page without escaping HTML entities or applying WordPress sanitization functions like sanitize_text_field() or esc_attr(). WordPress's unfiltered_html capability, when disabled or restricted in multisite environments, prevents administrators from directly embedding HTML, making client-side XSS payloads in plugin output exploitable even for high-privilege users who lack explicit script execution permissions.

RemediationAI

Update the rexCrawler plugin to a patched version released after 1.0.15; check the official WordPress plugin repository (https://plugins.wordpress.org/rexcrawler/) or Wordfence advisory for the fixed version number and installation instructions. The plugin author (larsdrasmussen) should have released a patch implementing proper input sanitization (via WordPress functions like sanitize_text_field()) and output escaping (via esc_attr() or esc_html()) on the 'url' and 'regex' parameters in admin_regex_test.php. Until patching is completed, administrators of affected WordPress installations should restrict access to the search-pattern tester page via firewall rules or web application firewall (WAF) rules blocking requests to admin_regex_test.php with URL or regex query parameters, and should audit access logs for evidence of exploitation attempts. Organizations unable to patch immediately should consider disabling the rexCrawler plugin entirely if its core functionality is not critical.