What is the CVSS score of CVE-2026-56007?

CVE-2026-56007 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Ocean Product Sharing CVE-2026-56007

EUVD-2026-37870 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 Patchstack

GHSA-5h7g-227p-mv5r

WordPress XSS Oceanwp Wordpress Plugin Ocean Product Sharing

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Requires WordPress admin credentials (PR:H, AV:N); stored payload fires in victim browsers (S:C, UI:R); availability impact omitted as stored XSS does not disrupt service.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 11:16 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS.

This issue affects Ocean Product Sharing: from n/a through 2.2.2.

AnalysisAI

Stored XSS in OceanWP's Ocean Product Sharing WordPress plugin (all versions through 2.2.2) allows administrator-level attackers to persist malicious JavaScript into plugin configuration or product sharing fields. When other authenticated users or site visitors load affected product pages, the injected scripts execute in their browsers, enabling session cookie theft, credential harvesting, or unauthorized UI manipulation. No public exploit code has been identified and no active exploitation is confirmed (not in CISA KEV) at time of analysis; real-world risk is constrained by the PR:H requirement.

Technical ContextAI

Ocean Product Sharing is a WordPress plugin by OceanWP that integrates social sharing buttons and product-sharing functionality into WooCommerce or WordPress product pages. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored variant: attacker-supplied input is persisted to the WordPress database without adequate sanitization or output encoding, and is then reflected back to all subsequent page visitors as executable script. The affected CPE is cpe:2.3:a:oceanwp:ocean_product_sharing:*:*:*:*:*:*:*:*, encompassing all releases through version 2.2.2. The scope change (S:C in the CVSS vector) is characteristic of Stored XSS, as the payload crosses from the server-side WordPress trust boundary into the victim's browser security context.

RemediationAI

The primary remediation is to update the Ocean Product Sharing plugin to a version beyond 2.2.2. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ocean-product-sharing/vulnerability/wordpress-ocean-product-sharing-plugin-2-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve to confirm the exact patched release version, as no specific fix version number was available in the provided data. If an immediate update is not possible, restrict access to the WordPress administrator panel to only fully trusted accounts and enforce strong, unique administrator credentials with MFA. As an additional compensating control, deploying a WAF rule targeting XSS payloads in plugin settings form submissions can reduce injection risk, though this may produce false positives if plugin fields legitimately accept HTML content. Disabling the Ocean Product Sharing plugin entirely until patching is feasible is the most effective temporary mitigation.