PT-2026-28035 · WordPress · Wp Custom Admin Interface

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-32521

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WP Custom Admin Interface versions through 7.42

Description The WP Custom Admin Interface software contains a flaw related to improper input handling during web page generation, leading to a Cross-site Scripting (XSS) condition. This specific instance is a DOM-Based XSS. The issue exists due to insufficient sanitization of input, potentially allowing an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update WP Custom Admin Interface to a version newer than 7.42.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-32521

Affected Products

Wp Custom Admin Interface

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-32521 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/wp-custom-admin-interface/vulnerability/wordpress-wp-custom-admin-interface-plugin-7-42-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2036911883736015302 · Twitter Post
• https://twitter.com/infoflowcloud/status/2036912641952584146 · Twitter Post