CVE-2026-57399

HighCVSS 7.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The Proxy & VPN Blocker WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This affects versions up to and including 3.5.8.

Risk Assessment

An attacker can inject a malicious script that executes in the browsers of administrators or users, potentially leading to session theft, account takeover, or website defacement.

Recommendation

Immediately update the Proxy & VPN Blocker plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.

Other vulnerabilities in Proxy & VPN Blocker

CVE-2025-69353Medium
Missing Authorization vulnerability in Proxy & VPN Blocker allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Stored XSS.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS