CVE-2026-57625: WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.8.5 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a stored or reflected cross-site scripting (XSS) vulnerability in the Admin and Site Enhancements (ASE) Pro WordPress plugin, affecting all versions up to and including 8.8.5. The flaw is reachable over the network without any authentication, but requires a victim to interact with attacker-supplied content, such as visiting a crafted page or clicking a malicious link. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to full account takeover, data theft, and unauthorized changes to site content. No fix version has been published; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted HTTP request to the exposed WordPress installation without needing a foothold on the host.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated external party who can reach the service.

• Victim interactionRequired

  A victim (typically a logged-in administrator or privileged user) must interact with attacker-supplied content, such as visiting a crafted URL or page that triggers the malicious script.

• Attack complexityDetail

  Exploit complexity is low; no race conditions, special memory layout, or environmental prerequisites are required, making the attack reliable and repeatable.

Blast Radius

• Attacker-controlled JavaScript executes in the victim's browser session, allowing theft of session cookies and authentication tokens for the affected WordPress site.
• Captured admin credentials or session tokens enable full takeover of the WordPress site, including creation of backdoor accounts and installation of malicious plugins.
• The attacker can modify page content, inject persistent malicious scripts into site pages, and redirect site visitors to external attacker-controlled destinations.
• Confidential data visible to the victim in the browser, including user records, configuration values, and unpublished content, is exposed to the attacker.