What is the CVSS score of CVE-2026-39703?

CVE-2026-39703 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Wpbits Addons For Elementor Page Builder CVE-2026-39703

EUVD-2026-20406 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-xrpw-3fmw-45qf

WordPress XSS Wpbits Addons For Elementor Page Builder Wordpress Plugin Wpbits

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:44 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20406

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through <= 1.8.1.

AnalysisAI

Stored cross-site scripting (XSS) in WPBITS Addons For Elementor Page Builder versions up to 1.8.1 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability stems from improper input sanitization during web page generation, enabling an attacker to persistently compromise site content and steal session tokens or perform administrative actions on behalf of legitimate users. EPSS exploitation probability is very low at 0.03%, indicating limited real-world attack likelihood despite moderate CVSS severity.

Technical ContextAI

The vulnerability exists in the wpbits-addons-for-elementor WordPress plugin (CWE-79: Improper Neutralization of Input During Web Page Generation), a page builder extension for Elementor. The plugin fails to properly sanitize or escape user-supplied input before rendering it in dynamically generated web pages, allowing attackers to inject arbitrary HTML and JavaScript code. Stored XSS vulnerabilities in WordPress plugins are particularly dangerous because the malicious payload persists in the database and affects all users who view the compromised content, unlike reflected XSS which requires social engineering. The plugin operates within the WordPress admin and front-end contexts, giving attackers access to both administrator panels and visitor-facing pages depending on where the XSS payload is injected.

RemediationAI

Update WPBITS Addons For Elementor Page Builder to a version newer than 1.8.1 once the patched release becomes available. Site administrators should immediately disable or remove the plugin if an update is not yet released and if the plugin contains exploitable content-creation features. For temporary mitigation before patching, restrict the ability to create or edit pages and posts using the plugin to trusted administrators only, and audit existing page content for any suspicious scripts. Monitor the Patchstack vulnerability database at https://patchstack.com/database for patched version availability and apply updates as soon as released.