CVE-2026-53737

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.1 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.

Vulnerability Details

Published Date

June 10, 2026

Last Modified

June 11, 2026

CWE ID

CWE-79

Source

NVD

Vendor

saas.group

Product

Juicer

External References

https://wordpress.org/plugins/juicer/
https://www.vulncheck.com/advisories/juicer-through-stored-cross-site-scripting-via-unescaped-api-response

CVE-2026-53737

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment