Unauthenticated Cross Site Scripting Vulnerability in AutomatorWP Plugin
CVE-2026-42775

7.1HIGH

Key Information:

Vendor

WordPress
Status
AutomatorWP
Vendor
CVE Published:
15 June 2026

What is CVE-2026-42775?

A vulnerability exists in the AutomatorWP plugin for WordPress, which allows unauthenticated users to execute arbitrary JavaScript code in the context of the affected site. This Cross Site Scripting (XSS) vulnerability is present in versions up to 5.7.2. Attackers can exploit this flaw to manipulate user sessions, steal sensitive information, or redirect users to malicious websites. Website administrators using this plugin should apply available updates promptly to mitigate these risks.

Affected Version(s)

AutomatorWP <= 5.7.2

References

https://patchstack.com/database/wordpress/plugin/automato...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo | Patchstack Bug Bounty Program
.