Vulnerability · Published Sep 26, 2026 · Assigned by Wordfence
CVE-2026-15273Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
Medium 6.4
In plain English
A medium-severity cross-site scripting in Automatic.css from Automatic.css. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 88.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator accesses the Activity Log settings page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Automatic.css | Automatic.css | 4.0.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/07d697c5-1c15-4d3a-8637-cc4fd408f209?source=cve
- https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/UI/Settings_Page/Activity_Log.php#L90
- https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Helpers/Logger.php#L187
- https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Plugin.php#L175
- https://plugins.trac.wordpress.org/browser/automaticcss-plugin/trunk/classes/Lib/WideEvents/Formatter/JsonFormatter.php#L25
- https://automaticcss.com/changelogs/