CVE-2026-57415

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Gift Vouchers plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 4.7.0.

Risk Assessment

An attacker can inject malicious JavaScript that executes in the browsers of administrators and users, potentially leading to session theft, account takeover, or content modification.

Recommendation

Immediately update the Gift Vouchers plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.

Other vulnerabilities in Gift Vouchers

CVE-2026-57412Medium
The Gift Vouchers plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.6.9.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen Gift Vouchers gift-voucher allows Stored XSS.This issue affects Gift Vouchers: from n/a through <= 4.7.0.