What the vulnerability does
01Description
Authenticated (admin+) Stored Cross-Site Scripting (XSS) in WP Maintenance plugin <= 6.0.7 versions.
CVE-2021-36828
MEDIUM
CVE-2021-36828: WordPress WP Maintenance plugin <= 6.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
CVSS base score
4.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Explanation of Vulnerability in Simple Terms
02Summary
WP Maintenance versions up to 6.0.7 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious scripts into the plugin settings that execute in other users' browsers when they view affected pages. The vulnerability requires admin privileges and user interaction to exploit, and impacts site integrity and user data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they access the site.
Potential impact on your site
04Site Impact
A compromised admin account can inject scripts affecting other users' sessions and data.
Conditions required to exploit
05Prerequisites
Administrator account access and victim must view a page containing the injected script.
Key dates
06Disclosure timeline
April 15, 2022
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-15662 Advanced Woo Labels <= 2.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter
CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-15333 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute
CVE-2026-15334 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
CVE-2026-15950 Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute
