Automatic.css vulnerabilities

Products

• Automatic.css 1

Latest Automatic.css CVEs

Newest publication first

1. CVE-2026-15273 Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI

   Published 2026-09-26

   Medium·CVSS 6.4

   The Automatic.css plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI in all version 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will exec...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.