CVE-2026-68567

HighCVSS 7.1

Published: 18/08/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

A Cross-site Scripting (DOM-Based XSS) vulnerability in the WordPress plugin EasyTest – Simplify A/B Testing stems from improper input neutralization during web page generation. Affects versions up to and including 1.0.1.

Risk Assessment

DOM-Based XSS can allow an attacker to execute malicious script in a user's browser, such as a site administrator. Risk applies to sites running the vulnerable plugin version.

Recommendation

Update the EasyTest plugin to a version later than 1.0.1 and consider deploying a Content-Security-Policy header.

Other vulnerabilities in EasyTest – Simplify A/B Testing

CVE-2025-63031Medium
The WordPress plugin EasyTest – Simplify A/B Testing through 1.0.1 contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS