ProSolution WP Client Reflected XSS in Admin Pages

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the ProSolution WP Client WordPress plugin versions before 2.0.11, stemming from insufficient input sanitization and output escaping in administrative pages. The plugin fails to properly validate and escape user-supplied parameters before reflecting them into HTML attributes, allowing attackers to inject malicious JavaScript code. This matters because WordPress administrators are high-value targets—compromising an admin session grants access to site configuration, user data, and plugin management. Organizations running affected plugin versions face risks of credential theft, unauthorized administrative actions, malware injection, and complete website compromise. Any WordPress installation using ProSolution WP Client before version 2.0.11 is potentially vulnerable, with impact severity heightened by the privileged context of administrator accounts.

Casky's 322 matching skills leverage Claude AI with extended reasoning to identify the attack patterns behind this CVE across two critical MITRE ATT&CK phases: TA0001 (Initial Access) and TA0043 (Reconnaissance). When practitioners query Casky's platform, they would surface detection patterns for reflected XSS payloads in URL parameters targeting WordPress admin panels, techniques for social engineering administrators into clicking malicious links, and indicators of exploitation attempts in web logs showing suspicious parameter values in admin page requests. The platform would highlight the parameter injection point in the plugin code, correlate suspicious HTTP requests containing script tags or event handlers in query strings, and flag administrative sessions showing unexpected JavaScript execution. Practitioners would receive actionable findings showing exactly which request patterns indicate exploitation attempts, enabling them to identify compromised sessions, audit admin activity logs for unauthorized changes, and prioritize patching to version 2.0.11 or later before attackers establish persistent access through the administrator context.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19056.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-19056

Casky has 322 skills that investigate the attack patterns behind CVE-2026-19056. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn