EUVD-2026-75534
GHSA-vq53-4334-rch2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running WPCS ≤ 1.3.2
-
DeliveryCraft URL or input with XSS payload in vulnerable parameter
-
ExploitDeliver link to victim via phishing or forum
-
ExecutionVictim loads crafted page in browser
-
PersistInjected script executes under site origin
-
ImpactExfiltrate admin session token or perform privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must have the WPCS WordPress currency switcher plugin installed and active at version 1.3.2 or earlier. No attacker authentication is required (PR:N per CVSS vector). The attack does require user interaction - a victim must load or interact with a crafted URL or page (UI:R per CVSS vector), meaning purely automated exploitation without social engineering is not possible. The specific vulnerable parameter is not named in available data. Exploitation is limited to sites with this specific plugin active; removing or updating the plugin eliminates the attack surface entirely. |
| Impact | The CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) accurately captures the attack profile: network-reachable, low complexity, no authentication needed, but requiring a victim to load a crafted link or page. The Scope:Changed component elevates the score by acknowledging the browser-context boundary crossing. EPSS data is not present in the input, and the vulnerability has not been added to CISA KEV, suggesting no confirmed mass exploitation at this time. No public POC has been identified. Nonetheless, even a mid-sized municipal IT team in kalisz running a WooCommerce store on this plugin should treat this as urgent: WordPress admin sessions are long-lived, admin-targeted XSS routinely leads to full site compromise via malicious plugin installation or credential redirection, and the unauthenticated delivery requirement means any internet-exposed site is in scope. The input-reported A:L (availability) impact is mildly overstated for a typical XSS scenario where direct availability impact is not established - this is flagged in confidence notes. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running WPCS ≤ 1.3.2 and crafts a URL containing a JavaScript payload within a vulnerable currency switcher parameter. The attacker distributes the URL via phishing email or forum post targeting the site's administrators; when an admin loads the crafted page, the payload executes in their authenticated browser session, exfiltrating their session cookie or silently installing a backdoor plugin via the WordPress REST API. No public POC has been identified, but the low-complexity, unauthenticated nature of the flaw makes independent discovery straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
RemediationAI
The primary remediation is to update the WPCS plugin to a version beyond 1.3.2 via the WordPress plugin repository or the vendor's release channel. The exact patched version is not specified in available input data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/currency-switcher/vulnerability/wordpress-wpcs-plugin-1-3-2-cross-site-scripting-xss-vulnerability for the confirmed fixed release before updating. If a patched version is not yet published, immediately deactivate the WPCS plugin to eliminate the attack surface; this will disable currency-switching functionality. As a compensating control while a patch is applied, configure a WAF rule (e.g., via Cloudflare, Wordfence, or equivalent) to block known XSS patterns in HTTP parameters handled by the currency switcher endpoint - note this may generate false positives on legitimate currency-related inputs. Restricting plugin access to logged-in users only (if the currency switcher can be configured that way) would also raise the bar from PR:N to PR:L.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPCS is a WordPress plugin authored by vendor realmag777 that provides currency-switching functionality, typically used alongside WooCommerce-based stores. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored without sufficient sanitization or encoding before being rendered in HTML output. The CPE cpe:2.3:a:realmag777:wpcs:*:*:*:*:*:*:*:* covers all releases through 1.3.2. The CVSS S:C (Scope Changed) metric is characteristic of browser-side XSS: the injected script executes under the victim site's origin, crossing the boundary between the web application and the user's browser security context. The specific vulnerable parameter or endpoint is not named in available data beyond the Patchstack advisory.
Know when Wpcs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS with user interaction and scope change; A:N because XSS does not establish direct availability impact on the server.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.
Executive ViewAI
The WPCS WordPress Currency Switcher plugin (versions ≤1.3.2) contains an unauthenticated cross-site scripting vulnerability allowing remote attackers to execute arbitrary JavaScript in users' browsers without authentication. Organizations running this plugin face immediate risk of administrator session hijacking, credential theft, and unauthorized administrative actions on their WordPress sites.
Interim mitigations pending vendor patch availability: (1) Disable and remove the vulnerable plugin from all WordPress sites; (2) Deploy WAF rules to filter XSS payloads targeting the plugin; (3) Enforce Content Security Policy headers blocking inline scripts; (4) Restrict WordPress admin access to VPN or approved IP ranges to reduce session hijacking exposure; (5) Enable real-time security monitoring and log alerting for exploitation signatures; (6) Deploy WordPress-specific security plugins with active XSS detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB