Unauthenticated XSS in Automatic Plugin

Executive Summary

CVE-2026-56045 is a Cross Site Scripting (XSS) vulnerability found in the WordPress Automatic Plugin versions prior to 3.135.1.

This vulnerability allows attackers to inject malicious scripts into the website, which execute when visitors access the site.

Exploitation requires user interaction, such as clicking a malicious link or submitting a form, often initiated by a privileged user.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects the WordPress Automatic Plugin versions prior to 3.135.1 and involves Cross Site Scripting (XSS) that requires user interaction such as clicking a malicious link or submitting a form.

Detection can involve checking the plugin version installed on your WordPress site to see if it is older than 3.135.1.

Since the vulnerability involves malicious script injection, monitoring web traffic for suspicious scripts or unexpected redirects could help detect exploitation attempts.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited to execute malicious scripts on affected websites, potentially leading to unauthorized redirects, display of unwanted advertisements, or other malicious actions.

Because it has a CVSS score of 7.1, it represents a moderately dangerous risk that could be used in mass campaigns targeting thousands of websites.

Successful exploitation requires user interaction but can compromise the integrity and security of the website and its visitors.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating the WordPress Automatic Plugin to version 3.135.1 or later.

Alternatively, applying a Patchstack mitigation rule can protect against this vulnerability.

Using Patchstack tools to automate updates and protection is also recommended.

Useful 0 Not Useful 0