What is the CVSS score of EUVD-2026-15536?

EUVD-2026-15536 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ultra Wordpress Admin are affected by EUVD-2026-15536?

CVE-2026-22523 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate EUVD-2026-15536?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Ultra Wordpress Admin EUVD-2026-15536

| CVE-2026-22523 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-mq53-xgpg-4wjg

WordPress XSS Ultra Wordpress Admin Wordpress Plugin

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15536

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themepassion Ultra WordPress Admin ultra-admin allows Reflected XSS.This issue affects Ultra WordPress Admin: from n/a through <= 11.7.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Ultra WordPress Admin plugin (themepassion) through version 11.7, allowing attackers to inject malicious scripts into web pages viewed by administrators and users. The vulnerability stems from improper neutralization of user input during web page generation, classified under CWE-79. An attacker can craft a malicious URL containing JavaScript payloads that execute in the context of an authenticated user's browser session, potentially leading to session hijacking, credential theft, or unauthorized administrative actions without requiring authentication themselves.

Technical ContextAI

The vulnerability is a Reflected XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Ultra WordPress Admin plugin (CPE: cpe:2.3:a:themepassion:ultra_wordpress_admin:*:*:*:*:*:*:*:*), a WordPress administration enhancement tool developed by themepassion. The root cause involves the plugin failing to properly sanitize and escape user-supplied input before rendering it in HTML responses. WordPress plugins operating at the admin level have elevated privileges and access to sensitive administrative functions, making XSS vulnerabilities in this context particularly dangerous. Reflected XSS occurs when the payload is not stored server-side but rather passed through the URL or request parameters and immediately echoed back to the user without validation, allowing attackers to distribute malicious links that execute when victims click them.

RemediationAI

Organizations running Ultra WordPress Admin should upgrade to a version newer than 11.7 immediately upon availability of a patched release from themepassion. Monitor the Patchstack advisory page and the official Ultra WordPress Admin plugin repository for security updates. Until a patch is available, temporary mitigations include: (1) disabling the Ultra WordPress Admin plugin if it is not critical to operations, (2) restricting WordPress admin panel access (wp-admin) to specific IP ranges via firewall or web application firewall rules, (3) implementing Content Security Policy (CSP) headers to restrict inline script execution, and (4) enforcing HTTPS with HSTS to prevent man-in-the-middle injection of malicious URLs. Additionally, ensure that all WordPress administrators are trained not to click suspicious links, particularly those containing query parameters or unusual base64-encoded content.