CVE-2026-57704

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Smart Manager plugin version 8.90.0 and earlier contains an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Risk Assessment

Risk includes session hijacking, redirection to malicious sites, or theft of sensitive data. The attack does not require authentication, increasing the attack surface.

Recommendation

Immediately update the Smart Manager plugin to the latest available version. Also consider deploying a Web Application Firewall (WAF) to block common XSS patterns.

Other vulnerabilities in Smart Manager

CVE-2026-45216High
The Smart Manager plugin for WordPress contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions up to and including 8.85.0.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.