WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Why this deserves its current priority

CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Ultimate Dashboad/Ultimate Dashboard (generic), MapSteps UG/Ultimate Dashboard Pro (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Ultimate Dashboad/Ultimate Dashboard, MapSteps UG/Ultimate Dashboard Pro.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 18, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 25, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 18, 2026

Sources and claim methodology

• Source referencepatchstack.com
• Source referencepatchstack.com

Related CVEs

• Ekushey Project Manager CRM 5.0 Stored XSS via System Name FieldAlso CWE-79
• Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability lengthSame generic ecosystem
• NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoiSame generic ecosystem
• Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_countSame generic ecosystem
• Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VISame generic ecosystem
• Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VISame generic ecosystem