What is the CVSS score of EUVD-2026-41279?

EUVD-2026-41279 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ASE Pro are affected by EUVD-2026-41279?

The ASE Pro WordPress plugin (versions 8.8.5 and earlier) contains a critical cross-site scripting vulnerability allowing unauthenticated attackers to execute malicious scripts and hijack…

How to fix or mitigate EUVD-2026-41279?

Within 24 hours: audit all WordPress instances for ASE Pro installations and document affected systems. Within 7 days: disable the ASE Pro plugin or completely remove it from all affected WordPress sites; evaluate alternative plugins for required functionality. Within 30 days: monitor official ASE Pro channels and WordPress.org security advisories for patch availability; implement a vendor security assessment process to prevent similar vulnerable plugins in the future.

ASE Pro EUVD-2026-41279

| CVE-2026-57625 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-r269-6x8w-gh3v

WordPress XSS Wordpress Plugin Admin And Site Enhancements Ase Pro

9.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Unauthenticated network XSS needing victim interaction (UI:R) with scope change into the admin origin; high confidentiality via session theft, limited integrity, no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:02 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

AnalysisAI

Stored/reflected cross-site scripting in the Admin and Site Enhancements (ASE) Pro WordPress plugin (versions 8.8.5 and earlier) allows unauthenticated remote attackers to inject malicious scripts that execute in a victim's browser once they view the affected page or follow a crafted link. Because the flaw requires no authentication and carries a scope-changing CVSS 3.1 score of 9.6, a single successful lure can lead to admin session hijacking and full site takeover. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is Admin and Site Enhancements (ASE) Pro (CPE cpe:2.3:a:ase:admin_and_site_enhancements_(ase)_pro), a commercial WordPress plugin that bundles a large set of administrative, security, and optimization utilities for WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into an HTML response without adequate output encoding or input sanitization, allowing arbitrary HTML/JavaScript to be interpreted by the browser. Because WordPress plugins run inside the site's trust boundary and the CVSS scope is marked Changed (S:C), the injected script executes in the context of the WordPress admin/site origin, enabling actions against the authenticated dashboard.

RemediationAI

Upgrade ASE Pro to a version later than 8.8.5 once the vendor publishes a fixed release; the input data specifies the vulnerable ceiling (<= 8.8.5) but does not include an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro/vulnerability/wordpress-admin-and-site-enhancements-ase-pro-plugin-8-8-5-cross-site-scripting-xss-vulnerability) and the plugin vendor for the corrected build. Until a patched version is confirmed and applied, compensating controls include placing a Web Application Firewall or Patchstack's virtual patching in front of the site to filter XSS payloads (trade-off: rule tuning may cause false positives on legitimate rich content), restricting access to the affected plugin/admin endpoints by IP or authentication where feasible (trade-off: may impede legitimate remote admins), and enforcing a strict Content-Security-Policy that disallows inline script execution (trade-off: can break themes/plugins relying on inline JS). Administrators should also avoid clicking untrusted links while logged in to reduce the UI:R lure vector.