EUVD-2026-50120
GHSA-r4j4-29v7-6qph
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network CSRF with no attacker auth (PR:N) but requires admin interaction (UI:R); stored XSS runs in victim browsers so scope changes (S:C) with limited C/I/A impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.
AnalysisAI
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Technical ContextAI
The affected component is the WOLF plugin for WordPress, a PHP-based CMS whose admin-facing actions are routed through the wp-admin AJAX endpoint (admin-ajax.php). WordPress security relies on per-request nonces (anti-CSRF tokens) and current_user_can() capability checks to authorize privileged operations; the vulnerable AJAX action omits both, so a forged cross-origin request carrying an authenticated admin's session cookies is accepted as legitimate. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), compounded by a missing-CSRF-protection weakness (CWE-352 class) that turns a nonce gap into a stored-XSS write primitive. The CPE (cpe:2.3:a:unknown:wolf:*) identifies the product generically as 'wolf' with an unknown vendor, reflecting limited registry metadata.
RemediationAI
Vendor-released patch: upgrade the WOLF plugin to version 1.1.0 or later, which introduces the missing nonce and capability checks on the affected AJAX action; this is the primary and complete fix. If immediate upgrade is not possible, deactivate the WOLF plugin until it can be updated, since the vulnerable AJAX action is exposed while the plugin is active. As additional compensating controls, deploy a WAF rule to block cross-origin POSTs to admin-ajax.php for the affected action and require admins to avoid clicking untrusted links during authenticated sessions - noting that WAF filtering of admin-ajax traffic can produce false positives against legitimate plugin AJAX calls. Refer to the WPScan advisory (https://wpscan.com/vulnerability/ba3b8f4a-772f-42ad-9c67-5623406118c1/) for confirmation of the fixed version.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today