What is the CVSS score of CVE-2026-40734?

CVE-2026-40734 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Categories Images CVE-2026-40734

Q: Which versions of Categories Images are affected by CVE-2026-40734?

DOM-based Cross-Site Scripting in the Zahlan Categories Images WordPress plugin through version 3.3.1 permits authenticated low-privileged attackers to inject arbitrary web scripts.

EUVD-2026-22889 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Patchstack

GHSA-rpp7-9x22-6v9f

WordPress XSS Categories Images Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:38 vuln.today

CVSS changed

Apr 16, 2026 - 15:22 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 10:45 euvd

EUVD-2026-22889

CVE Published

Apr 15, 2026 - 10:21 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.This issue affects Categories Images: from n/a through <= 3.3.1.

AnalysisAI

DOM-based Cross-Site Scripting in the Zahlan Categories Images WordPress plugin through version 3.3.1 permits authenticated low-privileged attackers to inject arbitrary web scripts. When a victim visits a page embedding the manipulated content, the script executes in their browser, potentially leading to session hijacking or content spoofing. No active exploitation or public exploit code has been identified; EPSS indicates very low exploitation probability (0.03%).