Junglewise Threat Intelligence

CVE-2026-7660: Easy Updates Manager WordPress plugin reflected XSS in paged parameter

CVE-2026-7660 · Severity: medium · CVSS 6.1 · Published 2026-05-28

Executive brief

Easy Updates Manager is a WordPress plugin used to manage site and plugin updates. A security flaw allows attackers to run malicious scripts in the browser of a site administrator if they can trick that administrator into clicking a malicious link. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.

Technical details

The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the pagination() function. Specifically, the 'paged' parameter is not properly handled before being rendered back to the page. An unauthenticated attacker can exploit this by crafting a malicious URL and using social engineering to trick an authenticated administrator into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is addressed in version 9.0.21.

Affected products

  • Easy Updates Manager Team Easy Updates Manager up to, and including, 9.0.20

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References