CVE-2026-42775
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Versions of AutomatorWP up to 5.7.2 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
Risk Assessment
This vulnerability may lead to user data theft and session hijacking, posing a serious threat to the application's security and its users.
Recommendation
It is recommended to update AutomatorWP to the latest version to mitigate this vulnerability and conduct a security audit of the application.
Other vulnerabilities in AutomatorWP
See all- CVE-2026-78266Medium
AutomatorWP versions up to 5.8.3 have a Subscriber Broken Access Control vulnerability, allowing subscribers to access unauthorized functionality.
- CVE-2026-76074Medium
The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve the site's Campaign Monitor mailing list catalog, including list IDs and names, which should be restricted to managers.
- CVE-2026-76057Medium
The AutomatorWP plugin for WordPress up to version 5.8.4 is vulnerable to authorization bypass due to improper verification of user permissions. Authenticated attackers with subscriber-level access or above can retrieve all ConvertKit form data configured by the site's manager, exposing integration details intended to be restricted to managers.
- CVE-2026-42650High
Versions of AutomatorWP up to 5.6.7 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-40785High
AutomatorWP versions up to 5.6.7 have a vulnerability in subscriber authentication, which may lead to unauthorized access.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.