What is GHSA-59cg-pg2j-hj7m?

GHSA-59cg-pg2j-hj7m is a security advisory published by GitHub Security Advisories with Medium severity. Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on...

Which CVE IDs does GHSA-59cg-pg2j-hj7m cover?

GHSA-59cg-pg2j-hj7m covers the following CVE IDs: CVE-2026-53737. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-59cg-pg2j-hj7m?

GHSA-59cg-pg2j-hj7m has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

GHSA-59cg-pg2j-hj7mMediumCVSS 6.1

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on...

Vendor

GitHub Security Advisories

Published

June 11, 2026

Last Modified

June 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-53737 →

📋 Description

Juicer through 1.12.18 fails to escape remote feed API response fields before rendering them on the admin settings page. Attackers controlling the connected feed data can inject script that executes in an administrator's browser when the settings page loads.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-53737
https://wordpress.org/plugins/juicer
https://www.vulncheck.com/advisories/juicer-through-stored-cross-site-scripting-via-unescaped-api-response
https://github.com/advisories/GHSA-59cg-pg2j-hj7m