What is the CVSS score of CVE-2026-39500?

CVE-2026-39500 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Themesflat Addons For Elementor CVE-2026-39500

EUVD-2026-20165 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-9w47-rc65-v592

WordPress XSS Themesflat Addons For Elementor Wordpress Plugin Themesflat

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:40 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20165

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through <= 2.3.2.

AnalysisAI

Stored Cross-Site Scripting (XSS) in Themesflat Addons for Elementor up to version 2.3.2 allows authenticated users with low privileges to inject malicious scripts that execute in the context of site visitors' browsers. An attacker with contributor-level access or higher can craft input fields within the plugin's admin interface to persistently store JavaScript code, which then executes whenever other users (including administrators) view the affected content. The vulnerability has low real-world exploitation risk (EPSS 0.03%, percentile 8%) despite its CVSS 6.5 rating, as it requires authenticated user interaction and user-initiated viewing of affected pages.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Themesflat Addons for Elementor WordPress plugin, which provides additional widget and functionality extensions for the Elementor page builder. The plugin fails to properly sanitize and escape user-supplied input before rendering it on the frontend, allowing authenticated users to embed malicious JavaScript within plugin-specific fields. When these fields are rendered on the page, the unescaped JavaScript executes in the context of site visitors' sessions. The affected product is identified by CPE cpe:2.3:a:themesflat:themesflat-addons-for-elementor and impacts all versions from the initial release through version 2.3.2.

RemediationAI

Update Themesflat Addons for Elementor to a version newer than 2.3.2 when available. Site administrators should review the plugin's changelog and Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/themesflat-addons-for-elementor/vulnerability/wordpress-themesflat-addons-for-elementor-plugin-2-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve) for patched version details. As an interim mitigation, restrict plugin access to only trusted administrators and editors, limit contributor-level account creation, and monitor admin activity logs for suspicious use of plugin fields. Additionally, run WordPress security plugins that detect and filter stored XSS payloads.