What is the CVSS score of CVE-2026-56046?

CVE-2026-56046 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

ListingPro CVE-2026-56046

EUVD-2026-39707 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-pmwg-h2c7-w359

WordPress XSS Wordpress Theme

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered XSS requires subscriber auth (PR:L) and victim page view (UI:R) with browser scope change; availability impact is not a realistic XSS outcome and is assessed as N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:20 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.

AnalysisAI

Stored Cross-Site Scripting in ListingPro WordPress theme versions 2.9.11 and below allows authenticated subscriber-level users to inject malicious JavaScript that executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) confirms the injected payload breaks out of the application's security boundary and runs in the victim's browser context, enabling session hijacking or unauthorized actions on behalf of higher-privileged users. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

ListingPro is a commercial WordPress theme designed for directory and business listing websites. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient sanitization or output encoding of subscriber-controlled input before it is rendered in HTML responses. The CVSS vector's scope change (S:C) is characteristic of XSS: while the vulnerability originates in the WordPress application, the payload executes within a different security principal - the victim's browser session. The PR:L metric confirms that WordPress subscriber-level access (the lowest authenticated role, typically granted on open-registration sites) is sufficient to introduce the payload, lowering the barrier to exploitation. No CPE string was provided in the source data, but the affected product is confirmed as the ListingPro theme by Patchstack and EUVD (EUVD-2026-39707).

RemediationAI

Update the ListingPro WordPress theme to a version released after 2.9.11 as soon as one is available from the vendor; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/listingpro/vulnerability/wordpress-listingpro-theme-2-9-11-cross-site-scripting-xss-vulnerability for patch availability updates. No specific patched version number was confirmed in the available data, so verify the fix directly with the theme vendor before upgrading. As a compensating control pending a patch, disable open subscriber registration to prevent unauthenticated parties from obtaining the low-privilege access required for exploitation - note this may break site workflows that depend on user-submitted listings. Additionally, deploying a WAF rule targeting reflected script injection in form inputs can reduce risk, though it will not catch all stored XSS variants. Content Security Policy (CSP) headers configured to restrict inline script execution can limit the impact of successful injection.