CVE-2026-39683
DOM-Based XSS in Garden Gnome Package ≤ 2.4.1 Allows Code Injection
Publication date: 2026-04-08
Last updated on: 2026-04-13
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| garden_gnome | garden_gnome_package | to 2.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Cross Site Scripting (XSS) issue that allows attackers to inject malicious scripts into a website, potentially compromising user data and site integrity.
Such vulnerabilities can impact compliance with standards like GDPR and HIPAA because they may lead to unauthorized access or exposure of personal or sensitive data through malicious script execution.
However, the provided information does not explicitly mention the direct effects of this vulnerability on compliance with these regulations.
Can you explain this vulnerability to me?
CVE-2026-39683 is a Cross Site Scripting (XSS) vulnerability in the WordPress Garden Gnome Package Plugin versions up to and including 2.4.1.
This vulnerability allows an attacker to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, into a website. These scripts execute when visitors access the compromised site.
Exploitation requires user interaction by a privileged user (such as an author or developer) who must perform an action like clicking a malicious link, visiting a crafted page, or submitting a form.
No official patch is currently available, and the affected plugin versions remain vulnerable.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute malicious scripts on your website, potentially leading to unauthorized redirects, displaying unwanted advertisements, or injecting harmful HTML content.
Such actions can compromise the integrity and trustworthiness of your website, potentially harming your users and damaging your site's reputation.
Exploitation depends on privileged user interaction, so the risk is higher if users with elevated permissions are tricked into performing certain actions.
Although considered low priority and unlikely to be widely exploited, this vulnerability can be part of mass-exploit campaigns targeting many websites.
Immediate mitigation involves updating the affected plugin or seeking assistance from your hosting provider or web developer.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the affected Garden Gnome Package plugin to a version newer than 2.4.1.
If updating is not possible, users are advised to seek assistance from their hosting provider or web developer to implement alternative protective measures.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a DOM-Based Cross-Site Scripting (XSS) issue in the Garden Gnome Package WordPress plugin up to version 2.4.1. Detection typically involves identifying if the vulnerable plugin version is installed and checking for suspicious script injections or unusual behavior in web pages generated by the plugin.
Since no official patch is available and the vulnerability requires user interaction with crafted inputs, detection can include:
- Checking the installed plugin version to confirm if it is 2.4.1 or earlier.
- Monitoring web traffic and logs for unusual or suspicious script payloads or redirects that could indicate exploitation attempts.
- Using web vulnerability scanners that support detection of DOM-based XSS vulnerabilities on the affected plugin.
Specific commands to check the plugin version on a WordPress installation might include:
- Using WP-CLI: `wp plugin list | grep garden-gnome-package` to identify the installed version.
- Searching plugin files for suspicious injected scripts or payloads using commands like `grep -r --include='*.php' 'script' wp-content/plugins/garden-gnome-package/`.
For network detection, monitoring HTTP requests and responses for injected scripts or unusual parameters related to the plugin's pages can help identify exploitation attempts.