CVE-2026-53737

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days.

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-06-10
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

References

https://wordpress.org/plugins/juicer/
https://www.vulncheck.com/advisories/juicer-through-stored-cross-site-scripting-via-unescaped-api-response

Check your stack JSON