Platform
wordpress
Component
mymedi
Fixed in
1.7.8
CVE-2026-25351 describes a Reflected Cross-Site Scripting (XSS) vulnerability discovered in the MyMedi WordPress plugin. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users, potentially leading to account compromise and data theft. The vulnerability impacts versions of MyMedi from 0.0.0 up to and including 1.7.7, and a patch is available in version 1.7.7.
Successful exploitation of CVE-2026-25351 allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can be leveraged to steal session cookies, redirect users to malicious websites, deface the website, or even gain control of the user's WordPress account. The impact is particularly severe because XSS vulnerabilities are often difficult to detect and can be exploited silently. An attacker could craft a malicious link or embed the script in a seemingly legitimate page, tricking users into executing the code. This vulnerability could be used to compromise sensitive data stored within the WordPress site or to launch further attacks against other systems accessible to the compromised user.
CVE-2026-25351 was publicly disclosed on 2026-03-25. No public proof-of-concept exploits are currently known, but the ease of exploitation for reflected XSS vulnerabilities suggests a potential for rapid exploitation. The EPSS score is likely to be medium, given the widespread use of WordPress and the relative simplicity of exploiting reflected XSS. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-25351 is to immediately upgrade the MyMedi plugin to version 1.7.7 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on all user-supplied data within the MyMedi plugin. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. Regularly scan your WordPress installation for vulnerabilities using a reputable security plugin.
Update to version 1.7.7, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25351 is a Reflected XSS vulnerability in the MyMedi WordPress plugin allowing attackers to inject malicious scripts. It affects versions 0.0.0 through 1.7.7 and can lead to data theft or account compromise.
If you are using MyMedi version 0.0.0 through 1.7.7 on your WordPress site, you are potentially affected by this vulnerability. Check your plugin version immediately.
Upgrade the MyMedi plugin to version 1.7.7 or later to resolve this vulnerability. If immediate upgrade is not possible, consider input validation and WAF rules.
While no public exploits are currently known, the ease of exploitation suggests a potential for rapid exploitation. Monitor security advisories for updates.
Refer to the MyMedi plugin's official website or WordPress plugin repository for the latest security advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.