CVE-2026-57625

CriticalCVSS 9.6/10Last modified Oct 25, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ASEAdmin and Site Enhancements (ASE) Pro<= 8.8.5

References

Timeline

Published
Jul 2, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-576267.1Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 thrCVE-2026-576274.9Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-576287.6Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-576296.5Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.CVE-2026-576305.3Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576317.6Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-576325.4Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-576335.3Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.CVE-2026-576344.3Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.CVE-2026-576356.5Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.CVE-2026-576368.5Contributor SQL Injection in wpForo Forum <= 3.0.9 versions.CVE-2026-576374.3Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions.
CVE-2026-57625: Critical severity, CVSS 9.6 | Vulnix