What is the CVSS score of CVE-2026-39508?

CVE-2026-39508 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Advanced Coupons For Woocommerce Coupons CVE-2026-39508

EUVD-2026-20175 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-mv96-qr2j-4hgg

WordPress XSS Advanced Coupons For Woocommerce Coupons Wordpress Plugin Josh Kohlbach

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20175

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows DOM-Based XSS.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.7.1.1.

AnalysisAI

DOM-based cross-site scripting (XSS) in Advanced Coupons for WooCommerce Coupons plugin (versions up to 4.7.1.1) allows authenticated attackers with low privileges to inject malicious scripts that execute in users' browsers with the same privileges as the site context, affecting confidentiality, integrity, and availability of the WordPress installation. The vulnerability has an EPSS score of 0.03% (8th percentile), indicating low real-world exploitation probability despite the moderate CVSS 6.5 rating.

Technical ContextAI

This is a DOM-based XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a WordPress plugin that fails to properly sanitize and validate user input before rendering it in the Document Object Model. DOM-based XSS differs from reflected or stored XSS in that the vulnerability exists in client-side JavaScript code rather than server-side generation; malicious input is processed by the browser's DOM APIs without adequate output encoding. The Advanced Coupons for WooCommerce Coupons plugin (CPE: cpe:2.3:a:josh_kohlbach:advanced_coupons_for_woocommerce_coupons:*:*:*:*:*:*:*:*) is a WordPress plugin distributed through the free WordPress.org plugin repository, making it accessible to any WordPress site administrator who installs it.

RemediationAI

Update the Advanced Coupons for WooCommerce Coupons plugin to a version later than 4.7.1.1; consult the plugin's release history or vendor advisory for the specific patched version. WordPress site administrators should navigate to Plugins > Installed Plugins and update the plugin immediately if a newer version is available. As a temporary mitigation before patching, restrict coupon creation and editing permissions to highly trusted administrator accounts only, and monitor for unauthorized modifications to coupon configurations. Review the official Patchstack advisory and WordPress plugin repository for confirmation of the fix version before updating, as version numbering may vary.