Description
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
Published: 2026-06-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unauthenticated Reflected Cross Site Scripting (XSS) allows an attacker to inject arbitrary client‑side scripts into the browsing session of any user who visits a vulnerable page. The flaw resides in the Okay Toolkit plugin for WordPress and is classified as CWE‑79. Successful exploitation may enable the execution of arbitrary JavaScript on the victim’s browser, potentially affecting the user experience or altering the presentation of the site from the user’s perspective.

Affected Systems

The vulnerability affects WordPress sites that have the ArrayHQ Okay Toolkit plugin version 2.3 or earlier installed. Any site running these versions is potentially exposed.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate severity. The EPSS score of less than 1% suggests exploitation is currently unlikely, and the flaw is not listed in CISA’s KEV catalog. The attack vector is inferred to involve a reflected request parameter in the plugin’s exposed endpoints, allowing an unauthenticated attacker to craft a malicious URL that injects script content into the page.

Generated by OpenCVE AI on June 17, 2026 at 23:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Okay Toolkit plugin to the latest version (2.4 or newer).
  • If an update is not immediately possible, disable or uninstall the plugin to eliminate the risk surface.
  • Deploy a Web Application Firewall or configure a strong Content Security Policy to block reflected XSS payloads.

Generated by OpenCVE AI on June 17, 2026 at 23:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Arrayhq
Arrayhq okay Toolkit
Wordpress
Wordpress wordpress
Vendors & Products Arrayhq
Arrayhq okay Toolkit
Wordpress
Wordpress wordpress

Tue, 16 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 15 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
Title WordPress Okay Toolkit plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Arrayhq Okay Toolkit
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-16T14:58:19.463Z

Reserved: 2025-12-24T14:00:10.433Z

Link: CVE-2025-68851

cve-icon Vulnrichment

Updated: 2026-06-16T14:58:11.397Z

cve-icon NVD

Status : Deferred

Published: 2026-06-15T21:16:38.443

Modified: 2026-06-15T21:24:32.790

Link: CVE-2025-68851

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:08:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')