{"id":"CVE-2026-9577","aliases":["EUVD-2026-47887","GHSA-x9fx-2h43-2prm"],"status":"published","title":"Post Status Notifier Lite \u003c 1.13.0 - Reflected XSS via mod Parameter","description":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00242,"percentile":0.15424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-07-23T06:00:03Z","modified":"2026-07-23T15:31:47Z","products":[{"vendor":"unknown","product":"post status notifier lite"},{"vendor":"worschtebrot","product":"post status notifier lite"}],"references":[{"url":"https://wpscan.com/vulnerability/b316e14a-4260-43c4-996c-345c7f9f7d74/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9577"},{"url":"https://wpscan.com/vulnerability/b316e14a-4260-43c4-996c-345c7f9f7d74"},{"url":"https://github.com/advisories/GHSA-x9fx-2h43-2prm"}],"sources":{"cve":[{"id":"CVE-2026-9577","title":"Post Status Notifier Lite \u003c 1.13.0 - Reflected XSS via mod Parameter","description":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.","status":"published","published":"2026-07-23T06:00:03.344Z","modified":"2026-07-23T14:11:39.035Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-47887","description":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.","status":"published","published":"2026-07-23T06:00:03Z","modified":"2026-07-23T14:11:39Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:44.021778Z"}],"ghsa":[{"id":"GHSA-x9fx-2h43-2prm","title":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod`...","description":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.","status":"published","published":"2026-07-23T09:32:00Z","modified":"2026-07-23T15:31:47Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:09:43.143268Z"}],"nvd":[{"id":"CVE-2026-9577","description":"The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL.","status":"published","published":"2026-07-23T07:16:32.933Z","modified":"2026-07-23T15:18:19.363Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}