What is the CVSS score of CVE-2026-39451?

CVE-2026-39451 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

WP Google Review Slider CVE-2026-39451

EUVD-2026-36930 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-3xm9-v8wr-3w5j

Google XSS Wp Google Review Slider

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Availability impact is None - reflected XSS inherently affects confidentiality and integrity (session theft, DOM manipulation) but does not disrupt service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 23:15 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.

AnalysisAI

Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.

Technical ContextAI

The affected component is the WP Google Review Slider WordPress plugin, developed by jgwhite33 (CPE: cpe:2.3:a:jgwhite33:wp_google_review_slider:*:*:*:*:*:*:*:*), which embeds Google business review widgets on WordPress sites. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input is reflected or rendered in a web page context without adequate sanitization or output encoding. This class of flaw is pervasive in WordPress plugins that handle dynamic user-facing content - the plugin likely passes unsanitized query parameters or shortcode attributes directly into rendered HTML. Since the CVSS vector specifies PR:N and UI:R, the XSS is likely reflected rather than stored, requiring an attacker to trick a victim into visiting a crafted URL, though stored variants are possible if form inputs are involved.

RemediationAI

Update the WP Google Review Slider plugin to a version above 18.0 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-google-places-review-slider/vulnerability/wordpress-wp-google-review-slider-plugin-17-7-cross-site-scripting-xss-vulnerability should be consulted for the confirmed patched release version, as the exact fix version is not independently confirmed in the available intelligence data. If an immediate update is not possible, a compensating control is to deactivate the plugin entirely until patching is feasible - this eliminates exposure with no trade-off beyond loss of Google review display functionality. Web application firewall (WAF) rules targeting reflected XSS payloads in URL parameters can reduce but not eliminate risk, as WAF bypass techniques are well known for XSS.