CVE-2026-39683
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Garden Gnome Package plugin for WordPress versions up to and including 2.4.1 contains a DOM-Based XSS vulnerability due to improper input neutralization during page generation, allowing DOM-based XSS attacks.
Risk Assessment
An attacker can exploit the vulnerability to execute malicious scripts in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the Garden Gnome Package plugin to a version above 2.4.1 as soon as the vendor releases a fix.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chief Gnome Garden Gnome Package garden-gnome-package allows DOM-Based XSS.This issue affects Garden Gnome Package: from n/a through <= 2.4.1.