Atomic Edge analysis of CVE-2026-57625 (metadata-based): This vulnerability affects the Admin and Site Enhancements (ASE) Pro plugin for WordPress, versions up to and including 8.8.5. It is an unauthenticated stored cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary web scripts that execute when any user accesses a compromised page. The CVSS score is 7.2 (High), with network access, low complexity, no privileges required, and no user interaction needed.
The root cause is insufficient input sanitization and output escaping. Based on the CWE-79 classification, the plugin likely fails to sanitize user-supplied input before storing it in the database, and fails to escape that stored data when rendering it on a page. Without source code, this is an inferred assessment. The vulnerability is unauthenticated, meaning the vulnerable functionality does not require a nonce or capability check. The plugin’s purpose is to enhance admin and site functionality, so the vulnerable component likely involves a form or endpoint that accepts arbitrary input from visitors (such as a contact form, feedback submission, or custom post creation). Atomic Edge analysis infers that the vulnerable code probably processes input through an AJAX handler, REST endpoint, or shortcode without applying WordPress sanitization functions like sanitize_text_field() or escaping functions like esc_html().
Exploitation is straightforward. An attacker sends a crafted HTTP request containing a JavaScript payload. The payload could be injected via a POST parameter to an AJAX action like ‘ase_pro_save_data’ or a REST endpoint under ‘/wp-json/ase-pro/v1/’. The attacker does not need authentication. The payload is stored server-side and later executed in the browser of any user who views the compromised page. A sample payload could be ‘alert(document.cookie)’ embedded in a name, message, or configuration field. The attacker would target a public-facing form or endpoint that the plugin exposes.
Remediation requires the plugin developers to implement proper input sanitization and output escaping. For stored input, using functions like sanitize_text_field(), sanitize_textarea_field(), or wp_kses() is essential. For output, the plugin must escape data with esc_html(), esc_attr(), or wp_kses_post() depending on the context. The plugin should also enforce nonce verification and capability checks for any data submission, even if the feature appears to be public-facing. The patched version 8.8.6 likely applies these fixes.
Impact includes arbitrary script execution in the context of any user viewing the affected page. An unauthenticated attacker can steal session cookies, perform actions on behalf of an administrator, redirect users to malicious sites, or deface the site. Since the CVSS scope is changed, the attack can affect resources beyond the vulnerable component. The severity is high because the attack requires no authentication and no user interaction beyond normal page viewing.
