Wp Custom Admin Interface EUVD-2026-15885

Despite the absence of a published CVSS score and EPSS value, this vulnerability warrants high-priority treatment based on multiple risk signals: (1) The attack vector is network-based with likely low complexity, as DOM-XSS typically requires only crafting a malicious URL or exploiting user interaction; (2) The affected component (WordPress admin interface plugin) processes privileged administrative actions, elevating the technical impact from information disclosure to account compromise; (3) The ENISA EUVD tracking (EUVD-2026-15885) indicates official EU vulnerability database recognition, suggesting wider attention; (4) The broad version range (through 7.42 with no explicit lower bound) indicates a long-standing exposure window. The primary mitigating factor is that exploitation requires tricking an authenticated admin into clicking a malicious link, reducing the attack surface compared to unauthenticated XSS. However, the administrative context and plugin's deep WordPress integration elevate real-world risk significantly.

An attacker crafts a malicious URL containing JavaScript payload encoded in URL parameters that the WP Custom Admin Interface plugin processes without sanitization, then tricks a WordPress administrator via phishing email to click the link while logged into the admin panel. When the administrator visits the malicious URL, the unescaped user input is reflected into the DOM, causing the JavaScript to execute with the same privileges as the logged-in administrator, allowing the attacker to steal the admin session token, create new admin accounts, or exfiltrate sensitive site data. No public proof-of-concept is required—DOM-XSS exploitation via URL manipulation is a mature attack technique.