EUVD-2026-89929
GHSA-8whj-mhq6-32ph
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor account
-
DeliveryInject XSS payload into plugin field
-
ExploitStore malicious script
-
ExecutionAdmin/user views page
-
PersistScript executes in victim browser
-
ImpactSession hijack or privilege actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with at least Contributor-level privileges (PR:L) on a site running the OAuth Server / oauth2-provider plugin version 4.5.1 or earlier, plus victim user interaction (UI:R) - a higher-privileged user must view the page containing the injected payload for the script to execute. Exploitation is limited by the need for a valid low-privilege account (sites disallowing untrusted user registration or Contributor roles are largely unaffected) and by the required social-engineering/victim-view step. The exact vulnerable feature or field is not specified in the available description. |
| Impact | This is a moderate-severity, low-real-world-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes a network-reachable but authenticated (PR:L) stored/reflected XSS requiring victim interaction (UI:R), with only Low impact across confidentiality, integrity, and availability despite the scope change (S:C) that lifts the score. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so exploitation status is 'no public exploit identified at time of analysis.' The gating requirement for a Contributor-level authenticated account plus victim interaction sharply limits mass exploitation; this is a defense-in-depth hardening fix rather than an urgent emergency. The primary uncertainty is the sparse Patchstack description, which names neither the injectable parameter nor the sink, so the exact injection point and whether it is stored versus reflected cannot be confirmed from available data. |
| Exploit ScenarioDerived | An attacker who has obtained (or registered for) a WordPress Contributor account on a site running OAuth Server <= 4.5.1 submits a crafted payload into a plugin field that is not properly sanitized. When a higher-privileged user (e.g. an administrator) or another user views the affected page, the injected JavaScript executes in their browser session, potentially enabling session/cookie theft or actions in the victim's context. No public PoC is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Cross-site scripting in the WordPress OAuth Server plugin (oauth2-provider) through version 4.5.1 lets an authenticated Contributor-level user inject script that executes in the browser of a higher-privileged victim who views the affected page. Because exploitation requires a valid low-privilege account plus victim interaction, exposure is limited on sites that do not allow untrusted registration or Contributor roles, and the issue is a moderate-severity, low-real-world-priority one (CVSS 6.5). No public exploit code was identified at time of analysis, and the specific vulnerable field or parameter is not documented in the available Patchstack advisory.
RemediationAI
The available data does not identify a patched release, so treat the plugin as unfixed until a vendor update is confirmed: monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/oauth2-provider/vulnerability/wordpress-oauth-server-plugin-4-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress.org plugin page for a version newer than 4.5.1 and apply it as soon as it appears, since the absence of a documented fix version in this data does not prove the vendor has not shipped one. If no update is available yet or cannot be deployed immediately, remove the attack prerequisite rather than relying on generic hardening: disable open user registration and withdraw or tightly control Contributor-level roles for untrusted accounts (trade-off: editorial workflows that depend on Contributor submissions will stop working), and review draft or submitted content authored by low-privilege users for injected markup in case the injection point persists. A WAF or reverse-proxy signature blocking script markup on requests to the plugin's endpoints can serve as interim compensation, but such rules risk false positives against legitimate content and should be tuned and treated as temporary only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in the OAuth Server WordPress plugin from vendor jayson_t_cote, which provides OAuth 2.0 authorization-server functionality for WordPress (WordPress.org slug oauth2-provider). Input handled by the plugin is rendered into a page without adequate encoding, so script markup supplied by a low-privileged author is executed in the browser of a more privileged viewer. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L confirms a network-reachable, low-complexity attack that requires low privileges (Contributor-level) and victim interaction, while the changed scope (S:C) indicates execution escapes the component's original security context into the surrounding WordPress administrative origin, the classic path toward session or anti-CSRF token theft against an administrator. The CPE cpe:2.3:a:jayson_t_cote:oauth_server:*:*:*:*:*:*:*:* identifies the product but leaves the version field wildcarded, so it does not pin a fixed release; the only affected range documented anywhere in the supplied data is 'up to and including 4.5.1' from the CVE description.
Know when Oauth Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Contributor account needed (PR:L), victim must view injected content (UI:R), XSS executes in a different security context (S:C) with limited low impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB