External risk intelligence

Admin and Site Enhancements Pro Unauthenticated Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-57625

The vulnerability exists in a WordPress plugin. WordPress plugins are commonly used to extend the functionality of public-facing websites, making them internet-accessible by default in typical deployment scenarios.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security flaw affecting the Admin and Site Enhancements Pro plugin, specifically impacting its ability to prevent malicious code injection. While the vulnerability is unauthenticated, meaning no login is required to exploit it, its primary concern at this stage is confirming if this specific plugin is in use within our digital infrastructure.

Allows unauthenticated malicious code injection.
Confirm use of this specific plugin.
Understand exposure and verify product relevance.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to a web application that uses the affected plugin. Because no authentication is required, the attacker can reach the vulnerable component directly over the network. When a user views the content delivered by the vulnerable component, the malicious script is executed. This could allow an attacker to take over a user's session or modify the site's content.

No authentication needed.
User views crafted content.
Session hijacking or content modification.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers could inject malicious scripts into websites using the affected plugin, potentially leading to unauthorized actions or data exposure within the context of a user's session. This occurs when a user interacts with a specially crafted link or content, triggering the script execution within their browser.

User session data.
Malicious scripts injected via crafted links.
Unauthorized actions in user sessions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated Cross-Site Scripting vulnerability in Admin and Site Enhancements Pro affects public-facing websites. Initially, identify all instances of the affected plugin, confirm its exposure to the internet, and then pinpoint the accountable owner, likely application or platform teams. Plan remediation based on business criticality and exposure.

Application owners should own the issue.
Verify plugin reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Admin and Site Enhancements (ASE) Pro plugin?

Admin and Site Enhancements (ASE) Pro is a WordPress plugin designed to extend the functionality of a website. It is typically used by administrators to manage site configurations, improve performance, or add specific features without needing to write custom code. Because it integrates directly into the WordPress environment, it serves as a foundational component for the sites where it is installed.

What does CWE-79 mean in the context of CVE-2026-57625?

CWE-79 refers to Cross-Site Scripting (XSS). This weakness occurs when an application includes untrusted data in a web page without proper validation or escaping. In CVE-2026-57625, this flaw allows an attacker to inject malicious scripts into the site. When other users view the compromised page, the browser runs the unauthorized script, potentially giving the attacker access to the user's session data or the ability to alter what the user sees.

How is this vulnerability triggered?

An attacker triggers this bug by sending a specially crafted request to a website using the vulnerable plugin. This process does not require the attacker to have an account or login credentials. The script execution is specifically activated when a user interacts with content that has been manipulated by the attacker. Simply browsing the site normally without encountering this crafted content does not trigger the execution of the malicious script.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this vulnerability is classified as likely to be relevant because it affects a WordPress plugin. Since these plugins are commonly used to support public-facing websites, the affected code is often accessible over the internet by default. If your instance of ASE Pro is installed on a site reachable by the public, you should consider the application exposed to potential network-based exploitation.

What should I do if I use ASE Pro on my site?

Your first step is to verify if you are running a version of the Admin and Site Enhancements Pro plugin at or below version 8.8.5. Once confirmed, identify the specific instances of this plugin within your digital infrastructure and determine their business criticality. Engage your application or platform teams to prioritize the plugin management and coordinate the necessary updates to secure your site against unauthorized script injection.

References

patchstack.com/database/wordpress/plugin/admin-site-enhancements-pro…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.