CVE-2026-7662: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joshin85 Plugin Name: ePaperFlip Publisher
The ePaperFlip Publisher WordPress plugin up to version 1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'publicationid' attribute of the epaperflip_embed shortcode. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No official patch or remediation has been confirmed as of the published date.
AI Analysis
Technical Summary
CVE-2026-7662 describes a stored Cross-Site Scripting vulnerability in the ePaperFlip Publisher plugin for WordPress. The issue exists in all versions up to and including version 1, where the 'publicationid' attribute of the epaperflip_embed shortcode is not properly sanitized or escaped before being injected into inline JavaScript. This allows authenticated users with Contributor-level permissions or higher to inject malicious scripts that execute in the context of any user viewing the compromised page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No vendor advisory or patch links are available, and the remediation level is not specified.
Potential Impact
An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages via the 'publicationid' shortcode attribute. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure and integrity impacts. Availability is not affected. The vulnerability allows cross-site scripting with low attack complexity and no user interaction required, but requires some privileges on the WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the ePaperFlip Publisher plugin to prevent exploitation. Monitor for plugin updates or security advisories from the vendor or WordPress plugin repository.
CVE-2026-7662: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in joshin85 Plugin Name: ePaperFlip Publisher
Description
The ePaperFlip Publisher WordPress plugin up to version 1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'publicationid' attribute of the epaperflip_embed shortcode. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to inject arbitrary JavaScript that executes when other users view the affected pages. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity. No official patch or remediation has been confirmed as of the published date.
CVSS v3.1
Score 6.4medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-7662 describes a stored Cross-Site Scripting vulnerability in the ePaperFlip Publisher plugin for WordPress. The issue exists in all versions up to and including version 1, where the 'publicationid' attribute of the epaperflip_embed shortcode is not properly sanitized or escaped before being injected into inline JavaScript. This allows authenticated users with Contributor-level permissions or higher to inject malicious scripts that execute in the context of any user viewing the compromised page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No vendor advisory or patch links are available, and the remediation level is not specified.
Potential Impact
An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages via the 'publicationid' shortcode attribute. These scripts execute in the browsers of users who visit the infected pages, potentially leading to information disclosure and integrity impacts. Availability is not affected. The vulnerability allows cross-site scripting with low attack complexity and no user interaction required, but requires some privileges on the WordPress site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the ePaperFlip Publisher plugin to prevent exploitation. Monitor for plugin updates or security advisories from the vendor or WordPress plugin repository.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-05-01T19:39:44.324Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a279b36e29bf47b50359122
Added to database: 06/09/2026, 04:48:54 UTC
Last enriched: 06/16/2026, 08:38:32 UTC
Last updated: 07/31/2026, 19:23:00 UTC
Views: 35
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.