What is the CVSS score of CVE-2026-42750?

CVE-2026-42750 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WPComplete CVE-2026-42750

EUVD-2026-32199 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 audit@patchstack.com

GHSA-388h-jxj2-x3jp

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:39 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nexcess WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through <= 2.9.5.4.

AnalysisAI

Stored Cross-Site Scripting in the WPComplete WordPress plugin (all versions through 2.9.5.4) allows authenticated low-privileged users to inject persistent malicious scripts that execute in other users' browsers upon viewing affected content. The CVSS changed scope (S:C) is the critical risk factor: a contributor- or author-level account can craft payloads that execute in the session of higher-privileged users, including administrators, enabling session hijacking or unauthorized admin actions. No public exploit identified at time of analysis, and an EPSS score of 0.03% (10th percentile) reflects low broad exploitation probability, though the admin-targeting potential elevates real-world concern for multi-user WordPress deployments.

Technical ContextAI

WPComplete is a WordPress plugin developed by Nexcess that adds course and content completion tracking functionality to WordPress sites. CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant means user-supplied input is persisted server-side without adequate sanitization or output encoding, then rendered as executable HTML/JavaScript to subsequent page visitors. The CVSS vector AV:N/AC:L/PR:L/UI:R/S:C reflects that the attack is delivered over the network with low complexity, requires a low-privileged authenticated session to inject the payload, and requires a separate victim's browser interaction to trigger execution - at which point the scope changes (S:C), crossing the plugin's security boundary into the victim's browser context. No CPE string was provided in the available intelligence; affected versions are documented as WPComplete 0 through 2.9.5.4 inclusive per EUVD-2026-32199.

RemediationAI

No specific patched version number was confirmed in the available intelligence data; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wpcomplete/vulnerability/wordpress-wpcomplete-plugin-2-9-5-4-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted immediately to identify whether a fixed release above 2.9.5.4 is available in the WordPress plugin repository and to apply it. As an interim compensating control, restrict WordPress contributor and author roles exclusively to fully trusted internal users, since the attack requires PR:L authentication - removing untrusted or external accounts from these roles eliminates the injection vector entirely. If the plugin exposes specific input fields that accept free-form HTML or JavaScript, those fields should be identified and disabled or restricted via plugin settings if configurable. WordPress administrators should also consider deploying a Web Application Firewall rule (e.g., via Wordfence or Cloudflare) targeting stored XSS patterns in WPComplete-specific POST endpoints as a non-blocking defense layer; note this adds maintenance overhead and may produce false positives on legitimate rich-text content.