CVE-2026-2466
Reflected XSS in DukaPress Plugin Allows Admin Account Attacks
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dukapress | dukapress | to 3.2.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2466 is a Reflected Cross-Site Scripting (XSS) vulnerability in the DukaPress WordPress plugin versions up to and including 3.2.4.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the plugin does not properly sanitize and escape a parameter before outputting it back to the page. This allows attackers to inject malicious JavaScript code that executes in the context of users who view the affected page.'}, {'type': 'paragraph', 'content': "Specifically, an attacker can submit a crafted request with a malicious payload in the 'price' parameter to the plugin's AJAX handler, which then reflects this unsanitized input back to the user, triggering the execution of the injected script."}, {'type': 'paragraph', 'content': 'This flaw is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation) and is part of the OWASP Top 10 category A7 - Cross-Site Scripting (XSS).'}] [1]
How can this vulnerability impact me? :
This vulnerability can have serious impacts, especially for high-privilege users such as administrators.
- Execution of arbitrary JavaScript code in the context of authenticated users.
- Potential session hijacking, allowing attackers to take over user sessions.
- Privilege escalation, where attackers could gain higher access rights.
- Other attacks targeting admin users that could compromise the security and integrity of the WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by sending a crafted POST request to the plugin's AJAX handler endpoint and observing if the input is reflected unsanitized in the response, indicating a Reflected Cross-Site Scripting (XSS) flaw."}, {'type': 'paragraph', 'content': 'A suggested command to test this is using curl to submit a malicious payload in the `price` parameter to the `admin-ajax.php?action=dpsc_format_price` endpoint. For example:'}, {'type': 'list_item', 'content': 'curl -X POST -d "price=<script>alert(\'XSS\')</script>" https://yourwordpresssite.com/wp-admin/admin-ajax.php?action=dpsc_format_price'}, {'type': 'paragraph', 'content': 'If the response contains the injected script tags without sanitization or escaping, the vulnerability is present.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Restrict access to the WordPress admin area and AJAX endpoints to trusted users only.
- Implement Web Application Firewall (WAF) rules to detect and block malicious payloads targeting the vulnerable parameter.
- Avoid using or disable the DukaPress plugin until a fixed version is released.
- Educate administrators to be cautious of suspicious links or inputs that could trigger the XSS.