CVE-2026-68567

Deferred Deferred - Pending Action

Unauthenticated XSS in Convert Pro Plugin

Publication date: 2026-08-18

Last updated on: 2026-10-28

Assigner: Patchstack

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-10-28

Generated

2026-11-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68567

EUVD

EUVD-2026-60935

Affected Vendors & Products

Vendor	Product	Version / Range
convert_pro	convert_pro	to 1.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an Unauthenticated Cross Site Scripting (XSS) vulnerability in the Convert Pro WordPress plugin versions 1.0.1 and below. It allows attackers to inject malicious scripts into websites without authentication. Successful exploitation requires user interaction like clicking a link or submitting a form.

Detection Guidance

Detecting this XSS vulnerability requires checking the Convert Pro plugin version. Use WordPress admin to verify the installed version or run SQL queries on the database to check the plugin version in the wp_options table. Alternatively, scan for vulnerable versions using security tools like WPScan with the command: wpscan --url [your-site] --enumerate vp,vt.

Impact Analysis

Attackers could inject malicious scripts to redirect users, display unwanted ads, or steal sensitive data. The vulnerability has a CVSS score of 7.1, indicating moderate danger. It could be exploited in mass campaigns targeting many websites.

Compliance Impact

This XSS vulnerability could potentially expose user data by allowing attackers to inject malicious scripts that steal information or redirect users to phishing sites. This may lead to violations of GDPR if personal data is compromised, or HIPAA if protected health information is exposed. Compliance risks depend on the data processed by the affected WordPress plugin.

Mitigation Strategies

Immediately update the Convert Pro plugin to version 1.0.2 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is applied. Disable the plugin if no update is available and remove it if unused.

Hi! I’m here to help you understand CVE-2026-68567. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...