What is the CVSS score of CVE-2026-57354?

CVE-2026-57354 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

JetReviews CVE-2026-57354

EUVD-2026-41353 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-wvg9-j5ff-4m6w

WordPress XSS Wordpress Plugin Jetreviews Crocoblock Jetimpex Inc

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber access is required (PR:L), victim must render the page (UI:R), and scope changes to the browser/admin context (S:C); no availability impact is typical for stored XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:35 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in JetReviews <= 3.0.0.1 versions.

AnalysisAI

Stored Cross-Site Scripting in JetReviews plugin for WordPress (versions <= 3.0.0.1) allows subscriber-level authenticated users to inject malicious scripts into review fields that execute in victims' browsers when the content is viewed. The vulnerability carries a changed scope (S:C), meaning the injected payload breaks out of the plugin's context and can target higher-privileged users such as site administrators. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the prevalence of WordPress in production environments make this a credible escalation path to full site compromise.

Technical ContextAI

JetReviews is a premium WordPress plugin developed by Crocoblock (JetImpex Inc.), identified via CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetreviews:*:*:*:*:*:*:*:*. It provides review and rating widgets for WordPress-powered sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS where subscriber-role users can submit review content containing unsanitized script payloads. WordPress's subscriber role is the lowest authenticated role, requiring only account registration. The CVSS scope change (S:C) indicates the injected script executes in a browser security context different from the originating plugin - typically the victim's authenticated WordPress session, including the admin dashboard context if an administrator views the malicious review.

RemediationAI

Update JetReviews to a version above 3.0.0.1. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/jet-reviews/vulnerability/wordpress-jetreviews-plugin-3-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted for the confirmed patched release version, as no specific fixed version number was included in the available intelligence data. As a compensating control prior to patching, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to eliminate the subscriber-level access prerequisite - note this may impact legitimate registration flows. Additionally, implementing a Web Application Firewall rule to filter script injection patterns in review submission fields can reduce exposure. Administrators should audit recent review submissions for unexpected script tags or encoded payloads.