EUVD-2026-24638
GHSA-84px-h8hx-j764
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Private WP suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Exceptions' setting in all versions up to, and including, 0.4.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored cross-site scripting in Private WP Suite plugin for WordPress through version 0.4.1 allows authenticated administrators to inject arbitrary JavaScript via the Exceptions setting, which executes in the browsers of any user accessing affected pages. The vulnerability requires high-privilege authenticated access and only manifests in multi-site installations or those with unfiltered_html disabled, limiting real-world exposure despite network-accessible attack vector.
Technical ContextAI
The Private WP Suite WordPress plugin fails to properly sanitize and escape user input in the Exceptions configuration setting. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where attacker-controlled data is saved to the database and later rendered in HTML context without sanitization. WordPress plugins typically use functions like sanitize_text_field() during input and wp_kses_post() or esc_attr() during output; this plugin appears to use neither for the Exceptions field. The CPE cpe:2.3:a:fpoller:private_wp_suite:*:*:*:*:*:*:*:* identifies all versions of this WordPress plugin as affected through 0.4.1. Multi-site WordPress installations are specifically mentioned because they may have different sanitization rules or restrictions on HTML content compared to single-site setups.
RemediationAI
Update Private WP Suite to version 0.4.2 or later when available. If an immediate update is not possible, restrict the Exceptions setting to non-administrator users by implementing role-based access controls via WordPress capability filters, or disable the Exceptions feature entirely if it is not critical to operations. Additionally, ensure that unfiltered_html is enabled for trusted administrator accounts (if organizational policy permits) to reduce the attack surface, though this is a weak compensating control. For multi-site installations specifically, enforce strict content policies and regularly audit administrator accounts for unauthorized changes to the Exceptions field. Monitor page output for unexpected script tags as a detective control. The primary remediation remains patching; check the WordPress plugin repository or fpoller's official channels for patch release version numbers.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today