What is the CVSS score of CVE-2026-57387?

CVE-2026-57387 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of picu are affected by CVE-2026-57387?

The picu WordPress plugin (all versions through 3.5.1) contains a stored cross-site scripting vulnerability (CVE-2026-57387, CVSS 7.1) that allows attackers to inject persistent malicious scripts…

How to fix or mitigate CVE-2026-57387?

Within 24 hours, audit all WordPress installations for picu presence and document versions in use; determine whether the plugin is operationally critical and identify which user accounts have access. Within 7 days, either disable and remove picu if not essential, or if required for operations, restrict file uploads and editing permissions to a minimal trusted group, deploy Web Application Firewall rules to block XSS attack patterns, enable Multi-Factor Authentication on all administrative accounts, and configure real-time security monitoring with immediate alerts for suspicious administrative activity. Within 30 days, monitor vendor security advisories for patch release while conducting testing of alternative plugins or solutions offering equivalent functionality with stronger security; prepare and execute migration to validated alternatives.

picu CVE-2026-57387

EUVD-2026-43460 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Picu

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable stored XSS needing victim view (UI:R) and no privileges per vendor; scope changes as script runs in another user's context, with limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:02 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in picu picu picu allows Stored XSS.This issue affects picu: from n/a through <= 3.5.1.

AnalysisAI

Stored cross-site scripting in the picu WordPress plugin (all versions up to and including 3.5.1) lets an attacker inject persistent JavaScript that executes in the browser of any user who later views the affected page. Because the CVSS vector marks a scope change (S:C) and requires only user interaction (UI:R) with no privileges (PR:N), a crafted payload stored via picu can run in an administrator or reviewer session and act beyond the plugin's own boundary. No public exploit identified at time of analysis and the issue is not on CISA KEV; the 7.1 CVSS reflects moderate impact across confidentiality, integrity, and availability.

Technical ContextAI

picu is a WordPress plugin used for client photo proofing and selection, letting photographers publish galleries and collect client picks and comments through WordPress pages. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning user-supplied input is written into generated HTML without adequate output encoding or input sanitization. As a stored (persistent) XSS, the malicious input is saved server-side - likely through a picu collection field, comment, or submission handled by the plugin - and re-rendered to other users, so the payload executes automatically on page load rather than requiring a crafted link. The affected component is identified by CPE cpe:2.3:a:picu:picu:*:*:*:*:*:*:*:* covering all versions through 3.5.1.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/picu/vulnerability/wordpress-picu-plugin-3-5-1-cross-site-scripting-xss-vulnerability) for the fixed release and upgrade to any version above 3.5.1 once published. Until a fix is confirmed, restrict who can submit content that picu renders - limit access to the picu collection submission and comment endpoints to trusted, authenticated users, and place the site behind a WAF with XSS filtering rules (for example Patchstack's virtual patch) which blocks common payloads but can generate false positives on legitimate rich input. If the affected picu functionality is non-essential, deactivating the plugin fully removes exposure at the cost of losing the proofing feature; alternatively review and sanitize existing stored picu data for injected script before it is served to admins.