CVE-2023-49186

High

Published: 05 January 2026

Published

05 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0011 28.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-49186 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Patchstack (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2023-49186 is an Improper Neutralization of Input During Web Page Generation vulnerability that enables DOM-Based Cross-Site Scripting (XSS) in the KlbTheme Machic Core WordPress plugin. This flaw, classified under CWE-79, affects Machic Core versions from n/a through 1.2.6. The vulnerability was published on 2026-01-05T14:15:52.183 and carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L).

Attackers can exploit this vulnerability remotely over the network with low attack complexity and no required privileges, though it necessitates user interaction, such as clicking a malicious link. Upon successful exploitation, the changed scope allows low-level impacts to confidentiality, integrity, and availability, potentially enabling theft of user data, session hijacking, or malicious script execution within the victim's browser context.

The primary advisory reference is available at https://vdp.patchstack.com/database/wordpress/plugin/machic-core/vulnerability/wordpress-machic-core-plugin-1-2-6-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve, which details the vulnerability in the WordPress Machic Core plugin up to version 1.2.6 and provides guidance on mitigation through patching or other security measures.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2023-53191

Vulnerability details

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in KlbTheme Machic Core allows DOM-Based XSS.This issue affects Machic Core: from n/a through 1.2.6.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

Reflected/DOM-based XSS in public-facing WordPress plugin directly enables remote exploitation of web application (T1190) and browser session hijacking via injected scripts (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1