What is the CVSS score of EUVD-2026-43470?

EUVD-2026-43470 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Proxy & VPN Blocker are affected by EUVD-2026-43470?

The WordPress plugin 'Proxy & VPN Blocker' versions through 3.5.8 contain a stored cross-site scripting vulnerability that allows attackers to inject persistent malicious JavaScript affecting all…

How to fix or mitigate EUVD-2026-43470?

Within 24 hours: Immediately disable the 'Proxy & VPN Blocker' plugin across all WordPress instances and audit your environment for installations running versions 3.5.8 and earlier. Within 7 days: Completely remove the plugin and conduct forensic review of server logs, database records, and website content for evidence of malicious script injection or unauthorized modifications. Within 30 days: Implement an alternative security solution for proxy or VPN blocking functionality, evaluate the vendor's security practices and patch history, and monitor Patchstack and WordPress official plugin repositories for a patched version release; plan re-enablement only if a security update becomes available.

Proxy & VPN Blocker EUVD-2026-43470

| CVE-2026-57399 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Proxy Amp Vpn Blocker

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Stored XSS is network-reachable and low-complexity with a browser-context scope change and Low C/I/A; PR:L reflects that most Patchstack stored-XSS injection points require at least low-privileged access, though the input's PR:N is possible if truly unauthenticated.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:59 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Stored XSS.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.8.

AnalysisAI

Stored cross-site scripting in the WordPress plugin 'Proxy & VPN Blocker' (versions up to and including 3.5.8) lets attackers persist malicious JavaScript that executes in victims' browsers when an affected page is rendered. Reported by Patchstack and carrying a CVSS 3.1 score of 7.1 with a scope change, the flaw affects all releases from an unspecified initial version through 3.5.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:proxy_&_vpn_blocker:proxy_&_vpn_blocker) that blocks visitors connecting through proxies or VPNs. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning attacker-supplied input is stored server-side (in the WordPress database) and later reflected into an HTML page without proper output encoding or sanitization. Because it is 'Stored' rather than 'Reflected' XSS, the payload persists and fires for every user who views the tainted page or admin screen, executing in the security context of the WordPress site's origin.

RemediationAI

No vendor-released patch version is identified in the available data (the record states affected 'through <= 3.5.8' without naming a fixed release), so verify the current version at https://patchstack.com/database/Wordpress/Plugin/proxy-vpn-blocker/vulnerability/wordpress-proxy-vpn-blocker-plugin-3-5-8-cross-site-scripting-xss-vulnerability and upgrade to any release later than 3.5.8 once published. As compensating controls until a patch is confirmed, consider deactivating and removing the Proxy & VPN Blocker plugin (trade-off: loss of proxy/VPN filtering), placing a WAF rule or the Patchstack virtual patch in front of the site to filter script payloads on the plugin's input fields, restricting who can submit content that reaches the vulnerable field, and enforcing a strict Content-Security-Policy to reduce inline-script execution (trade-off: may break legitimate inline scripts and require tuning).