Executive brief
Easy Updates Manager is a WordPress plugin used to manage site and plugin updates. A security flaw allows attackers to run malicious scripts in the browser of a site administrator if they can trick that administrator into clicking a malicious link. This could lead to unauthorized actions being performed on the website or the theft of sensitive session information.
Technical details
The Easy Updates Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping in the pagination() function. Specifically, the 'paged' parameter is not properly handled before being rendered back to the page. An unauthenticated attacker can exploit this by crafting a malicious URL and using social engineering to trick an authenticated administrator into clicking it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is addressed in version 9.0.21.
Affected products
- Easy Updates Manager Team Easy Updates Manager up to, and including, 9.0.20
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_List_Table.php
- https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/tags/9.0.20/includes/MPSUM_Plugins_List_Table.php
- https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php
- https://plugins.trac.wordpress.org/browser/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_Plugins_List_Table.php
- https://plugins.trac.wordpress.org/changeset/3531188/stops-core-theme-and-plugin-updates/trunk/includes/MPSUM_List_Table.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.20&new_path=%2Fstops-core-theme-and-plugin-updates/tags/9.0.21
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbd989c-4d69-45c9-bcb9-44f9ab98b969?source=cve