What is the CVSS score of CVE-2026-39708?

CVE-2026-39708 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Uicore Elements CVE-2026-39708

EUVD-2026-20415 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-v5fx-2c92-mwpw

XSS Uicore Elements

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20415

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.14.

AnalysisAI

Stored cross-site scripting (XSS) in UiCore Elements WordPress plugin versions 1.3.14 and earlier allows authenticated users to inject malicious scripts into web pages, which execute in the browsers of other users viewing affected content. The vulnerability stems from improper input neutralization during page generation, affecting any WordPress installation using the plugin. No active exploitation has been confirmed, and the EPSS score of 0.03% indicates very low real-world exploitation probability despite the CVSS 6.5 score.

Technical ContextAI

UiCore Elements is a WordPress plugin (CPE: cpe:2.3:a:uicore:uicore_elements:*:*:*:*:*:*:*:*) that provides UI component building functionality. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw where user-supplied input is stored in the application and later rendered to other users without proper encoding or sanitization. This allows attackers with authenticated access to inject arbitrary JavaScript code that executes in victim browsers with the privileges of the affected WordPress site.

RemediationAI

Update UiCore Elements plugin to a version higher than 1.3.14. Website administrators should navigate to the WordPress plugin management interface, identify UiCore Elements, and apply the latest available update. As an interim workaround before patching is possible, restrict plugin access to only trusted administrators and audit existing content for suspicious script injections. Additional vulnerability details and remediation guidance are available from Patchstack (https://patchstack.com/database/Wordpress/Plugin/uicore-elements/) and the NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-39708).