What is the CVSS score of CVE-2026-42643?

CVE-2026-42643 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Image Widget CVE-2026-42643

EUVD-2026-26214 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-29 Patchstack

WordPress XSS Wordpress Plugin Image Widget Stellarwp

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Admin credentials required (PR:H); victim must visit page (UI:R); scope changes to browser (S:C); XSS confers no availability impact (A:N).

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:30 vuln.today

EUVD ID Assigned

Apr 29, 2026 - 11:30 euvd

EUVD-2026-26214

CVE Published

Apr 29, 2026 - 10:40 nvd

MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Widget image-widget allows Stored XSS.This issue affects Image Widget: from n/a through <= 4.4.11.

AnalysisAI

Stored XSS in StellarWP's Image Widget WordPress plugin (all versions through 4.4.11) allows a high-privileged attacker to plant persistent malicious JavaScript into widget configuration fields, which then executes in the browsers of any visitor loading pages that render the widget. The CVSS scope-change indicator (S:C) confirms the payload crosses from the admin backend into the victim's browser context. No public exploit code or active exploitation has been observed; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate negligible current threat activity.

Technical ContextAI

The affected component is the Image Widget plugin for WordPress, authored by StellarWP, identified by CPE cpe:2.3:a:stellarwp:image_widget:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Stored XSS class: user-supplied values - likely widget title, image link, alt text, or similar configuration fields - are persisted to the WordPress database and subsequently reflected into HTML output without adequate output encoding or escaping. Because WordPress widgets are rendered site-wide on any page or post where the widget is placed, a single injected payload can be replayed to all site visitors. The CVSS S:C (Changed Scope) confirms the exploit crosses the trust boundary from the administrative configuration interface to the unprivileged visitor's browser context.

RemediationAI

Monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/image-widget/vulnerability/wordpress-image-widget-plugin-4-4-11-cross-site-scripting-xss-vulnerability?_s_id=cve and the WordPress plugin repository for a patched release beyond version 4.4.11; no exact fix version has been confirmed in the available data, so do not upgrade blindly to an unverified build. If immediate patching is not possible, restrict widget configuration access to the minimum number of fully trusted administrator accounts and audit existing widget configurations for unexpected script tags or event-handler attributes. Deploying a strict Content Security Policy header (e.g., script-src 'self') on the affected site will limit the blast radius of any stored payload by blocking inline script execution in victim browsers, though this may break other site functionality and must be tested. Temporarily deactivating the Image Widget plugin on public-facing sites is the most definitive interim control with no residual XSS exposure, at the cost of losing widget display functionality.