Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.
Published: 2026-03-05
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The Awa Plugins Wordpress plugin is vulnerable to a Reflected Cross‑Site Scripting flaw caused by inadequate input sanitization during page rendering. A malicious attacker can craft a specially‑crafted URL that, when opened by a victim, causes arbitrary script to execute in the victim’s browser. This may lead to session hijacking, data theft, or page defacement. The weakness is identified as CWE‑79.

Affected Systems

fox‑themes Awa Plugins version 1.4.4 and all earlier releases are affected; versions newer than 1.4.4 are not impacted according to the vendor information.

Risk and Exploitability

The flaw has a CVSS score of 7.1, indicating a medium‑to‑high impact level. Exploit probability according to EPSS is reported as less than 1 %, suggesting a low likelihood of real‑world exploitation at present. This vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to entice a user to visit a crafted URL, meaning the vulnerability is exploitable via social‑engineering or phishing campaigns rather than requiring direct low‑privilege access.

Generated by OpenCVE AI on April 15, 2026 at 23:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Awa Plugins plugin to version 1.4.5 or later.
  • If an update is unavailable, configure a web application firewall or rewrite rule to block or sanitize suspicious query parameters that may carry JavaScript code.
  • Implement a Content Security Policy that blocks inline scripts to mitigate the impact of any remaining XSS vectors.

Generated by OpenCVE AI on April 15, 2026 at 23:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 06 Mar 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Fox-themes
Fox-themes awa Plugins
Wordpress
Wordpress wordpress
Vendors & Products Fox-themes
Fox-themes awa Plugins
Wordpress
Wordpress wordpress

Thu, 05 Mar 2026 06:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Awa Plugins awa-plugins allows Reflected XSS.This issue affects Awa Plugins: from n/a through <= 1.4.4.
Title WordPress Awa Plugins plugin <= 1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References

Subscriptions

Fox-themes Awa Plugins
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:15:02.365Z

Reserved: 2026-02-19T09:51:48.837Z

Link: CVE-2026-27359

cve-icon Vulnrichment

Updated: 2026-03-06T19:01:47.708Z

cve-icon NVD

Status : Deferred

Published: 2026-03-05T06:16:25.813

Modified: 2026-04-22T21:26:58.303

Link: CVE-2026-27359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T23:45:05Z

Weaknesses