CVE-2026-102384: WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is described as author XSS, and the CVSS vector requires high privileges. An attacker would need an authenticated account with author-level capabilities or equivalent elevated access.

Q: Does exploitation require user interaction?

Yes. The CVSS vector includes UI:R, indicating that a user must interact with attacker-controlled content for exploitation to occur.

Q: Which versions are affected?

Supreme Modules Lite versions 2.5.63 and earlier are identified as affected. The provided information does not specify a fixed version.

Published Sep 30, 2026

Updated

Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.

Affected Software

1 affected component

WordPress Supreme Modules Lite<=2.5.63

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Supreme Modules Lite to a version that resolves this vulnerability.
Fixed in 2.5.64

Event History

Sep 30, 2026

CVE Published

via MITRE·12:28 PM

Data Sourced

via MITRE·12:28 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is described as author XSS, and the CVSS vector requires high privileges. An attacker would need an authenticated account with author-level capabilities or equivalent elevated access.

Does exploitation require user interaction?