What is the CVSS score of CVE-2026-27403?

CVE-2026-27403 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Hubbub Lite CVE-2026-27403

EUVD-2026-48158 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-583w-xvr4-75jr

WordPress XSS Wordpress Plugin Hubbub Lite

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Availability impact assessed as N - stored XSS does not disrupt service availability; all other metrics align with contributor-level stored XSS with scope change.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:04 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Hubbub Lite <= 1.36.3 versions.

AnalysisAI

Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Hubbub Lite (CPE: cpe:2.3:a:nerdpress:hubbub_lite:*:*:*:*:*:*:*:*) is a social sharing WordPress plugin developed by Nerdpress, previously distributed under the slug 'social-pug'. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to adequately sanitize or encode contributor-supplied input before rendering it in HTML output. In the WordPress permission model, Contributors can draft and edit posts but cannot publish without editor/admin approval; this attack exploits that window to embed script payloads in plugin-rendered content. The network attack vector (AV:N) and changed scope (S:C) are consistent with a stored XSS pattern where the payload persists server-side and fires inside victim browsers on page load.

RemediationAI

Update the Hubbub Lite plugin to the version released after 1.36.3 via the WordPress plugin repository or the vendor's update channel; the exact patched version number is not independently confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/social-pug/vulnerability/wordpress-hubbub-lite-plugin-1-36-3-cross-site-scripting-xss-vulnerability for the confirmed fix version. As an immediate workaround where patching is not immediately possible, restrict Contributor-role registration and audit existing Contributor accounts for untrusted users, which removes the attacker's required foothold. Additionally, a Web Application Firewall (WAF) rule targeting common XSS payloads in plugin input fields can reduce exploitation probability, though this is not a substitute for patching. Note that deactivating the plugin eliminates the attack surface entirely but also removes social sharing functionality.