EUVD-2026-62377
GHSA-wh58-v2mf-j99q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS requires victim interaction (UI:R) and crosses browser scope boundary (S:C); no direct availability impact applies to XSS.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in BBQ Pro <= 3.9 versions.
AnalysisAI
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires no WordPress account or authentication - the CVSS PR:N metric confirms the attack is fully unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 High score is grounded in real attacker advantage: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and scope change (S:C) all apply simultaneously. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running BBQ Pro 3.9 or earlier, crafts a URL containing an XSS payload embedded in a vulnerable plugin parameter, and delivers it to a logged-in WordPress administrator via a phishing email or a malicious comment link on an unrelated site. When the administrator clicks the link, their browser executes the injected script in the WordPress admin context, allowing the attacker to exfiltrate the administrator's session cookie or silently install a malicious plugin. … |
| Remediation | Update BBQ Pro to the latest available version beyond 3.9 by checking the Plugin Planet website or the WordPress plugin repository directly - the exact fix version is not independently confirmed in available data, so verify against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/bbq-pro/vulnerability/wordpress-bbq-pro-plugin-3-9-cross-site-scripting-xss-vulnerability?_s_id=cve before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using BBQ Pro plugin versions 3.9 or earlier and assess exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today