What is the CVSS score of CVE-2026-57396?

CVE-2026-57396 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Free Gifts for WooCommerce are affected by CVE-2026-57396?

The Flintop Free Gifts for WooCommerce plugin (versions through 13.1.0) contains a stored cross-site scripting vulnerability allowing attackers to inject persistent malicious scripts that execute for…

How to fix or mitigate CVE-2026-57396?

Within 24 hours: Audit all production WordPress installations to identify whether the Flintop plugin is deployed and document affected sites; contact the vendor directly for patch timeline and guidance. Within 7 days: Deploy Web Application Firewall rules targeting script injection payloads, enforce strict Content Security Policy headers across affected sites, and disable the plugin if functionality can be replicated through alternative solutions. Within 30 days: Apply vendor-released patch when available, migrate to a patched alternative plugin, or establish continuous security monitoring and code review for sites that must retain the vulnerable plugin.

Free Gifts for WooCommerce CVE-2026-57396

EUVD-2026-43469 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Free Gifts For Woocommerce

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS in a WordPress plugin typically needs a low-privileged authenticated role to persist the payload (PR:L) and a victim to view it (UI:R); scope changes to the browser (S:C) with limited C/I and no real availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:00 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.

Articles & Coverage 1

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026

AnalysisAI

Stored cross-site scripting in the Flintop "Free Gifts for WooCommerce" WordPress plugin (all versions through 13.1.0) lets an attacker inject persistent JavaScript that executes in the browser of anyone viewing the affected page. Reported by Patchstack and tracked as CWE-79, it carries a CVSS 7.1 score driven by a changed scope (S:C), and has no public exploit identified at time of analysis. No CISA KEV listing or POC has been reported, so this is a disclosed-but-not-yet-weaponized web plugin flaw.

Technical ContextAI

The affected component is a WordPress e-commerce plugin that extends WooCommerce to offer free-gift promotions, identified by CPE cpe:2.3:a:flintop:free_gifts_for_woocommerce. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: user- or operator-supplied input is written into generated HTML without adequate output encoding or sanitization, so injected markup is stored server-side and later rendered as active script. Because it is a stored (persistent) XSS, the payload lives in the site's database - likely in a plugin setting, gift configuration, or a field submitted through WooCommerce workflows - and re-executes every time the tainted page is loaded, unlike reflected XSS that requires a crafted per-request link.

RemediationAI

No fixed version is stated in the available data - the affected range runs "through <= 13.1.0" with no confirmed patched release, so treat this as No vendor-released patch identified at time of analysis and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/free-gifts-for-woocommerce/vulnerability/wordpress-free-gifts-for-woocommerce-plugin-13-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org page for a release above 13.1.0, applying it as soon as it ships. As compensating controls until then: deploy a WordPress-aware WAF or virtual patch (Patchstack itself offers this) to filter XSS payloads targeting the plugin's endpoints; restrict which user roles can submit or edit the gift-related fields that feed the vulnerable output; and if the free-gift feature is non-essential, deactivate and remove the plugin to eliminate exposure entirely - with the trade-off that any active gift promotions will stop working. Adding a strict Content-Security-Policy that disallows inline script can reduce payload impact but may break other plugins/themes that rely on inline scripts.