What is the CVSS score of EUVD-2026-57942?

EUVD-2026-57942 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Maspik Spam Blacklist are affected by EUVD-2026-57942?

Maspik Spam Blacklist WordPress plugin (versions ≤ 2.9.1) contains a high-severity cross-site scripting vulnerability allowing unauthenticated remote attackers to inject arbitrary JavaScript-no…

How to fix or mitigate EUVD-2026-57942?

Within 24 hours, immediately deactivate the Maspik plugin on all WordPress installations and verify removal via the WordPress plugin dashboard; document affected sites and create a list of users who administered the plugin. Within 7 days, deploy a replacement spam filtering solution (such as Akismet or native WordPress spam controls) and implement Web Application Firewall rules blocking XSS patterns on existing WordPress endpoints. Within 30 days, audit all WordPress plugins organization-wide for unpatched vulnerabilities, establish a plugin update policy requiring patches within 14 days of release, and implement Content Security Policy headers on all WordPress sites.

Maspik Spam Blacklist EUVD-2026-57942

| CVE-2026-28003 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-73rm-hhh2-w9mf

WordPress XSS Wordpress Plugin Maspik Spam Blacklist

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-delivered XSS with browser scope change; A:N substituted for A:L as XSS does not typically disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:00 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Maspik - Spam blacklist <= 2.9.1 versions.

AnalysisAI

Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

Maspik - Spam Blacklist is a WordPress plugin authored by yonifre (CPE: cpe:2.3:a:yonifre:maspik_-_spam_blacklist:*:*:*:*:*:*:*:*) whose function is to filter spam entries from contact forms. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the plugin accepts external input without applying sufficient output encoding or escaping before injecting that input into a rendered HTML context. The CVSS S:C (Scope Changed) metric confirms the injected payload executes within the victim's browser security context rather than being confined to the plugin or server, a hallmark of client-side XSS. The PR:N metric confirms the attack requires no WordPress account, meaning form-submitting visitors - not just administrators - can serve as the attack delivery mechanism.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/contact-forms-anti-spam/vulnerability/wordpress-maspik-spam-blacklist-plugin-2-9-1-cross-site-scripting-xss-vulnerability for the specific patched release version and upgrade the plugin immediately - a patched version beyond 2.9.1 is the primary recommended fix, though the exact version number is not explicitly stated in the currently available data and should be verified directly from the WordPress plugin repository or Patchstack. If the plugin cannot be immediately updated, deploying a WAF rule (such as via Cloudflare, Wordfence, or Patchstack's virtual patching) to block or sanitize XSS payloads targeting the plugin's input handling is a viable interim control, with the trade-off of potential false positives on legitimate contact form submissions. Disabling the plugin entirely until a patch is applied fully eliminates the attack surface but removes active spam filtering, increasing spam submission volume.