What is the CVSS score of CVE-2026-56039?

CVE-2026-56039 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Quick Interest Slider are affected by CVE-2026-56039?

The Quick Interest Slider WordPress plugin (versions 3.1.6 and earlier) contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript…

How to fix or mitigate CVE-2026-56039?

Within 24 hours: Inventory all WordPress instances running Quick Interest Slider and document current versions in use. Within 7 days: Either disable the plugin if non-critical to operations, or implement compensating controls (WAF rules, Content Security Policy headers). Within 30 days: Monitor the plugin vendor's repository and security advisories for patch release; escalate to plugin maintainers if no patch timeline is published.

Quick Interest Slider CVE-2026-56039

EUVD-2026-39701 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-cx36-2wx4-c9rp

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable reflected XSS needing a victim click (UI:R, PR:N); injected script escapes the plugin into the site session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:44 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.

AnalysisAI

Reflected cross-site scripting in the Quick Interest Slider WordPress plugin (versions 3.1.6 and earlier) lets an unauthenticated attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious page. The CVSS 3.1 base score is 7.1 with a scope change, reflecting that script execution crosses the plugin's security boundary into the broader WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is Quick Interest Slider, a WordPress plugin used to build sign-up/interest slider widgets on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected back into an HTTP response without proper output encoding or input sanitization. Because this is a reflected (non-persistent) XSS, the malicious payload is delivered within the request itself - typically a query parameter - and echoed into the page, so the browser parses it as executable markup. The CVSS scope change (S:C) indicates the injected script runs in the context of the WordPress site rather than being confined to the vulnerable plugin sandbox, allowing it to act on the authenticated user's session.

RemediationAI

No fixed version was provided in the input data, so no vendor-released patch is independently confirmed at time of analysis; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quick-interest-slider/vulnerability/wordpress-quick-interest-slider-plugin-3-1-6-reflected-cross-site-scripting-xss-vulnerability) and the WordPress plugin repository for any release above 3.1.6 and upgrade as soon as one is available. Until a patch is confirmed, the most effective compensating control is to deactivate and remove the Quick Interest Slider plugin, which removes the vulnerable endpoint entirely at the cost of losing the slider feature. Alternatively, place a Web Application Firewall (such as Patchstack's vPatch or a comparable WAF rule) in front of the site to filter reflected XSS payloads targeting the plugin's parameters - this preserves functionality but depends on rule coverage and can be bypassed by novel payloads. Administrators should also avoid clicking untrusted links to their own site while logged in, since reflected XSS depends on victim interaction.