EUVD-2026-55021
GHSA-vgj5-89vw-rww2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Admin authentication required to write the payload (PR:H); victims must visit affected pages (UI:R); injected script executes in visitor browser context, confirming scope change (S:C).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
AnalysisAI
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the unfiltered_html capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
Technical ContextAI
Advanced Excerpt (CPE: cpe:2.3:a:unknown:advanced_excerpt:*:*:*:*:*:*:*:*) is a WordPress plugin that extends and customizes post excerpt rendering on the front end. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: at least one plugin settings field is stored without sanitization and rendered without escaping, meaning whatever value an admin saves is emitted verbatim into page HTML. WordPress enforces a capability gate (unfiltered_html) to prevent lower-privileged admins - particularly in multisite networks - from injecting raw HTML through normal content editing. This plugin's settings pathway sidesteps that gate entirely, allowing the stored payload to reach the DOM regardless of the admin's capability level. The S:C scope change in the CVSS vector reflects that the injected payload executes not in the admin's session but in the browser security context of every visitor loading affected pages.
RemediationAI
Update the Advanced Excerpt WordPress plugin to version 4.5 or later, which contains the vendor-released patch correcting the missing output escaping; this is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/2710686c-055c-460c-8480-573e394f24d8/. If immediate patching is not possible, super-administrators in WordPress multisite environments should audit which site-level admins have access to the Advanced Excerpt settings page and restrict or revoke that access until the patch is applied - this eliminates the ability to write the malicious payload without disabling the plugin entirely. Existing plugin settings should be reviewed and sanitized for injected script content. Deactivating the plugin entirely is a viable temporary workaround with the trade-off of losing excerpt customization functionality site-wide.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today