CVE-2026-57625 CRITICAL

CVE-2026-57625: WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability

Vendor Ase
Product Admin and Site Enhancements (ASE) Pro
Weakness CWE-79 · XSS
Published July 2, 2026
Last update July 2, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Admin and Site Enhancements (ASE) Pro through version 8.8.5 contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the site. An attacker can craft a malicious link or page that, when visited by a site administrator or user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in a user's browser to steal credentials, hijack sessions, or perform unauthorized actions.

Potential impact on your site

04Site Impact

Administrators and users visiting crafted links risk account compromise, data theft, and unauthorized site modifications.

Conditions required to exploit

05Prerequisites

Attacker must trick a user into visiting a malicious link or page (user interaction required). No authentication needed.

Key dates

06Disclosure timeline

July 2, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-57361 WordPress Survey Maker plugin <= 5.2.2.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-8351 RTMKit <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget 'Background Text' Parameter CVE-2026-4322 XSS in Raera's Destekz CVE-2026-57345 WordPress Internal Links Manager plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-57350 WordPress WP Debugging plugin <= 2.12.2 - Cross Site Scripting (XSS) vulnerability