Reflected Cross-Site Scripting Vulnerability in Easy Updates Manager Plugin for WordPress

CVE-2026-7660

What is CVE-2026-7660?

The Easy Updates Manager plugin for WordPress is prone to a Reflected Cross-Site Scripting issue due to inadequate input sanitization and output escaping in the pagination() function. This flaw allows attackers to manipulate the 'paged' parameter to inject arbitrary scripts into webpages viewed by users. If a malicious link is clicked by an administrator, it triggers the execution of the injected scripts within the context of the affected site, opening the door for further exploitation.

References