What is the CVSS score of CVE-2026-57415?

CVE-2026-57415 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Gift Vouchers are affected by CVE-2026-57415?

The Codemenschen Gift Vouchers WordPress plugin (versions up to 4.7.0) contains a stored cross-site scripting vulnerability enabling unauthenticated attackers to inject malicious scripts into…

How to fix or mitigate CVE-2026-57415?

Within 24 hours, identify all WordPress installations running Codemenschen Gift Vouchers version 4.7.0 or earlier and audit existing voucher content for suspicious script injection. Within 7 days, implement compensating controls by disabling the plugin if operationally feasible, restricting voucher creation and management capabilities to administrator-only roles, and deploying Web Application Firewall rules configured to block XSS attack patterns. Within 30 days, contact the plugin vendor to confirm patch timeline, evaluate alternative gift voucher solutions, and conduct a security assessment of any sites that may have experienced compromise during the exposure window.

Gift Vouchers CVE-2026-57415

EUVD-2026-43342 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Gift Vouchers Wordpress Plugin Codemenschen

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS typically needs an authenticated submission path (PR:L) and victim page-load (UI:R); scope changes to the browser (S:C) with low C/I impact and no real availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:55 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codemenschen Gift Vouchers gift-voucher allows Stored XSS.This issue affects Gift Vouchers: from n/a through <= 4.7.0.

AnalysisAI

Stored cross-site scripting in the Codemenschen 'Gift Vouchers' WordPress plugin (all versions up to and including 4.7.0) lets an attacker persist malicious script into plugin-managed content that later executes in the browser of any user who views the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates network-reachable, low-complexity injection with a scope change and required victim interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Gift Vouchers (gift-voucher) plugin for WordPress by vendor Codemenschen, identified by CPE cpe:2.3:a:codemenschen:gift_vouchers:*:*:*:*:*:*:*:*. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, meaning attacker-supplied input is stored server-side and later reflected into an HTML page without adequate output encoding or input sanitization. Because this is a Stored (persistent) XSS, the payload is saved in the WordPress database - plausibly through a voucher field, order/redemption form, or plugin setting - and re-served to every visitor or administrator who loads the rendering page, executing in their session context.

RemediationAI

No vendor-released patched version is identified in the available data - the advisory records affected versions through <= 4.7.0 without naming a fixed release, so the primary action is to monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gift-voucher/vulnerability/wordpress-gift-vouchers-plugin-4-7-0-cross-site-scripting-xss-vulnerability) and the WordPress.org plugin page and upgrade to a release later than 4.7.0 as soon as one is published. Until a fix is available, apply compensating controls: deploy a WAF or virtual patch (Patchstack offers virtual patching for this class) to filter XSS payloads on the plugin's form and admin endpoints; restrict who can submit voucher data by tightening capabilities and requiring authentication on redemption/creation forms; add a restrictive Content-Security-Policy header to limit inline script execution (side effect: may break legitimate inline scripts and require tuning); and if the plugin is not business-critical, deactivate and remove it (side effect: gift-voucher functionality is lost). Review stored voucher records for already-injected script before re-enabling.