What is the CVSS score of CVE-2026-39597?

CVE-2026-39597 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

WPZOOM Addons for Elementor CVE-2026-39597

EUVD-2026-37590 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

WordPress XSS Wpzoom Addons For Elementor Wordpress Plugin Wpzoom

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress endpoint (AV:N), trivial reflected payload (AC:L), no attacker auth (PR:N), victim click required (UI:R); scope change reflects script executing in victim's site context with low C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

HIGH 7.1

Analysis Generated

Jun 17, 2026 - 12:20 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in WPZOOM Addons for Elementor <= 1.3.4 versions.

AnalysisAI

Reflected cross-site scripting in the WPZOOM Addons for Elementor WordPress plugin (versions 1.3.4 and earlier) allows unauthenticated remote attackers to inject arbitrary script into a victim's browser session by tricking them into following a crafted link. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.1 with scope change, reflecting potential impact on the broader WordPress site context; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

WPZOOM Addons for Elementor is a WordPress plugin that extends the Elementor page builder with additional widgets and design modules. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controllable input is reflected back into rendered HTML without proper output encoding or input sanitization. Because WordPress plugins frequently echo request parameters into widget rendering paths or AJAX responses, an unsanitized parameter in any front-end-reachable handler can be reflected into the response and executed in the victim's browser under the site's origin. The CPE wildcard (cpe:2.3:a:wpzoom:wpzoom_addons_for_elementor:*) indicates all versions through 1.3.4 share the vulnerable code path.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided intelligence - administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpzoom-elementor-addons/vulnerability/wordpress-wpzoom-addons-for-elementor-plugin-1-3-4-reflected-cross-site-scripting-xss-vulnerability and update to the next release above 1.3.4 once published. As compensating controls until patched, deploy a WordPress WAF (such as Patchstack, Wordfence, or a generic ModSecurity ruleset) with reflected-XSS signatures covering the plugin's request handlers, restrict wp-admin access to known IP ranges to limit the blast radius of an admin clicking a malicious link, and consider temporarily deactivating the plugin if it is non-essential - noting that deactivation will break any Elementor pages relying on its widgets. Educate administrators to avoid following untrusted links while logged in, and enable a strict Content-Security-Policy that disallows inline scripts on the WordPress front-end to break the reflected payload, accepting that this may interfere with other plugins that rely on inline JavaScript.