What the vulnerability does
01Description
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in versions up to, and including, 9.0.20 This is due to insufficient input sanitization and output escaping in the pagination() function. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page granted they can trick an administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Easy Updates Manager versions 9.0.20 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in a victim's browser when they visit a crafted link. The vulnerability affects the site's integrity and can expose user data. A patch version has not been publicly identified.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in a victim's browser to steal data or perform actions on their behalf.
Potential impact on your site
04Site Impact
Users visiting crafted links could have their sessions hijacked, credentials stolen, or site content modified in their browsers.
Conditions required to exploit
05Prerequisites
Victim must click a malicious link or visit an attacker-controlled page that triggers the vulnerability.
Key dates
06Disclosure timeline
May 28, 2026
CVE published
May 28, 2026
Record updated
