What is the CVSS score of CVE-2026-57420?

CVE-2026-57420 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Author Box WP Lens CVE-2026-57420

EUVD-2026-43347 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Author Box Wp Lens

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-delivered stored XSS requires low-privilege account (PR:L) and active victim browsing (UI:R); S:C for cross-context script execution; A:N as XSS does not directly cause availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:23 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Netrr Author Box WP Lens author-box-for-divi allows Stored XSS.This issue affects Author Box WP Lens: from n/a through <= 2.1.5.

AnalysisAI

Stored cross-site scripting in the Author Box WP Lens WordPress plugin (versions through 2.1.5) enables authenticated low-privilege users to persist malicious JavaScript payloads that execute in the browsers of any user who views an affected page, including administrators. The CVSS scope change (S:C) reflects that the injected script runs in a different security context than where it was stored, meaning a contributor-level attacker can target higher-privileged victims browsing the same site. No public exploit identified at time of analysis and no CISA KEV listing; however, multi-author WordPress deployments with untrusted contributors face realistic risk of privilege escalation via session hijacking.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) in its stored variant arises when user-supplied data is persisted to a backend store - WordPress's database in this case - without adequate output encoding, and later echoed verbatim into rendered HTML. The affected product is the Author Box WP Lens plugin by Netrr (CPE: cpe:2.3:a:netrr:author_box_wp_lens), a widget originally built for the Divi page builder that renders author biography boxes on WordPress posts. Because WordPress plugins execute within the browser's origin context for the site, a stored payload in an author box field is delivered to every visitor of any page hosting that widget, and can access cookies, localStorage, and the DOM of the entire WordPress front-end or admin panel depending on which user triggers the render.

RemediationAI

Update the Author Box WP Lens plugin to a version above 2.1.5 if Netrr has released a patched build; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/author-box-for-divi/vulnerability/wordpress-author-box-wp-lens-plugin-2-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve for confirmation of the exact fixed version, as the current intelligence does not independently confirm a specific patched release number. If no patch is yet available, restrict write access to author box plugin fields exclusively to administrator-level roles, preventing Contributor and Author accounts from controlling the vulnerable input - note this may limit intended multi-author workflow. As an additional control, deploying a WordPress-aware WAF rule targeting stored XSS patterns in plugin settings endpoints can reduce risk without disabling the plugin entirely, though WAF rules do not eliminate the underlying flaw and may generate false positives on legitimate rich-text input.