What is the CVSS score of CVE-2026-57319?

CVE-2026-57319 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of FOX (WooCommerce Currency Switcher) are affected by CVE-2026-57319?

The FOX Currency Switcher Professional for WooCommerce plugin (≤1.4.8) contains a cross-site scripting vulnerability (CVSS 7.1) that allows unauthenticated attackers to inject malicious JavaScript…

How to fix or mitigate CVE-2026-57319?

Within 24 hours: Inventory all WooCommerce instances using FOX Currency Switcher Professional and assess whether this plugin is actively serving customer traffic. Within 7 days: Implement Web Application Firewall (WAF) rules to block XSS patterns targeting the plugin parameters, deploy Content Security Policy headers, and enable input validation at the application layer. Within 30 days: Contact the vendor for patch ETA; if no patch is released, evaluate replacing the plugin with an alternative currency switcher solution or disable the plugin entirely if not business-critical.

FOX (WooCommerce Currency Switcher) CVE-2026-57319

EUVD-2026-39732 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-874g-hvw2-65jp

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-delivered XSS (AV:N/PR:N) requiring victim interaction (UI:R); browser-context script execution crosses scope (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:52 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in FOX <= 1.4.8 versions.

AnalysisAI

Reflected/stored cross-site scripting in the FOX - Currency Switcher Professional for WooCommerce WordPress plugin (versions 1.4.8 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is marked changed, successful injection can affect resources beyond the vulnerable component, including the broader site session. This was reported by Patchstack (CVE-2026-57319, CVSS 7.1); no public exploit code has been identified and it is not listed in CISA KEV.

Technical ContextAI

FOX (originally WOOCS - WooCommerce Currency Switcher) is a WordPress plugin that lets WooCommerce stores display and convert prices across multiple currencies. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or rendered into HTML output without proper sanitization or output encoding. Per the CVSS vector (AV:N/UI:R/S:C/C:L/I:L/A:L), the flaw is reachable over the network by an unauthenticated actor but requires a victim to interact (e.g. click a link or load a poisoned page), and the changed scope (S:C) indicates the injected script can impact a security context different from the vulnerable plugin component - characteristic of browser-side script execution within the WordPress site origin. No CPE strings were provided in the input; the affected component is identified from the Patchstack advisory and version range only.

RemediationAI

Update the FOX / WooCommerce Currency Switcher plugin to a version newer than 1.4.8 as soon as the vendor publishes one; a specific fixed version was not provided in the available data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-currency-switcher/vulnerability/wordpress-fox-plugin-1-4-8-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org changelog for the patched release before upgrading. Until a patched version is confirmed and applied, compensating controls include deploying a Web Application Firewall or virtual patch (Patchstack and similar WordPress WAF/mTLS rulesets can block the XSS payload pattern) - trade-off: rule tuning may be needed to avoid breaking legitimate currency-switch parameters; adding a restrictive Content-Security-Policy header to limit inline-script execution - trade-off: may break themes/plugins relying on inline JS; and restricting or monitoring the plugin's exposed front-end endpoints. If the plugin is not essential, deactivating and removing it eliminates the exposure entirely.