What is the CVSS score of EUVD-2026-47887?

EUVD-2026-47887 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-47887?

Yes, a public proof-of-concept exploit is available for EUVD-2026-47887. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for EUVD-2026-47887?

Yes, a patch is available for EUVD-2026-47887. Update the affected software to the latest version immediately.

Post Status Notifier Lite EUVD-2026-47887

| CVE-2026-9577 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 WPScan

GHSA-x9fx-2h43-2prm

XSS WordPress PHP Post Status Notifier Lite

4.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

PR:H because only a logged-in WordPress administrator can be the victim; UI:R for mandatory admin click; S:C because XSS crosses plugin boundary into the admin browser session.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:05 vuln.today

Patch available

Jul 23, 2026 - 10:02 EUVD

CVE Published

Jul 23, 2026 - 06:00 cve.org

MEDIUM 4.8

CVE Published

Jul 23, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.

AnalysisAI

Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting admin.php?page=post-status-notifier-lite. The plugin fails to escape the mod GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.

Technical ContextAI

The affected component is the Post Status Notifier Lite WordPress plugin (CPE: cpe:2.3:a:unknown:post_status_notifier_lite:*:*:*:*:*:*:*:*), a PHP-based WordPress plugin that manages post-status change email notifications. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation): the plugin reads the mod URL parameter from user-controlled GET input and renders it directly into the HTML of the admin settings page without applying WordPress sanitization functions such as esc_attr() or esc_html(). This is a classic reflected (non-persistent) XSS pattern - the payload is never stored server-side, so the injected script only executes when the victim's browser loads the attacker-controlled URL. The CVSS Scope:Changed metric (S:C) is technically accurate: XSS in a WordPress admin page can affect resources beyond the plugin itself, including the WordPress session cookie, nonce tokens, and the ability to perform privileged admin actions through the victim's authenticated session.

RemediationAI

The primary remediation is to upgrade Post Status Notifier Lite to version 1.13.0 or later, which properly escapes the mod URL parameter before output. The patch is confirmed available per vendor advisory referenced at https://wpscan.com/vulnerability/b316e14a-4260-43c4-996c-345c7f9f7d74/. If immediate patching is blocked, the most effective compensating control is to restrict access to the WordPress admin area (/wp-admin/) by IP allowlist at the web server or WAF layer, which prevents an attacker from reaching the vulnerable endpoint even with a crafted URL - trade-off is operational friction for distributed admin teams. A WAF rule blocking script-injection patterns (angle brackets, javascript:, onerror=) in the mod query parameter on admin.php?page=post-status-notifier-lite can also mitigate the issue, though encoding bypass variants may circumvent naive rules. Additionally, security awareness for WordPress administrators to verify URL origins before clicking links from untrusted sources reduces the social-engineering dependency of this attack.