CVE-2026-39674

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

A DOM-based Cross-site Scripting vulnerability in the MK Google Directions plugin allows injection of malicious client-side scripts. The issue affects versions up to and including 3.1.1.

Risk Assessment

An attacker could execute arbitrary scripts in the victim's browser, potentially leading to session theft, redirects, or data theft.

Recommendation

Update the MK Google Directions plugin to the latest version that includes input sanitization fixes.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manoj Kumar MK Google Directions google-distance-calculator allows DOM-Based XSS.This issue affects MK Google Directions: from n/a through <= 3.1.1.