EUVD-2026-14173
GHSA-cf92-p96c-2rrg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The Comment Genius plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Analysis
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Comment Genius WordPress plugin versions up to 1.2.5, where the PHP_SELF server variable is insufficiently sanitized and escaped in output, allowing unauthenticated attackers to inject arbitrary JavaScript code. Affected users are WordPress site administrators and visitors who can be tricked into clicking malicious links. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today