What is the CVSS score of CVE-2026-57428?

CVE-2026-57428 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Sprout Clients are affected by CVE-2026-57428?

BoldGrid Sprout Clients WordPress plugin versions 3.2.3 and earlier contain a cross-site scripting vulnerability that allows attackers to inject malicious scripts into user sessions without…

How to fix or mitigate CVE-2026-57428?

Within 24 hours, scan all WordPress installations to identify deployment of BoldGrid Sprout Clients plugin and document installed versions; correlate findings with active user counts to assess organizational exposure. Within 7 days, disable or remove the plugin from production systems running version 3.2.3 or earlier; establish alert monitoring on BoldGrid's security advisory channels and vendor repositories for patch announcements. Within 30 days, develop and test a patch deployment process with the vendor's released fix version in a staging environment, then deploy to production following a monitored rollout schedule.

Sprout Clients CVE-2026-57428

EUVD-2026-48170 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-85w7-5wwq-733g

WordPress XSS Sprout Clients Wordpress Plugin Boldgrid

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated but victim-interaction-dependent reflected XSS (PR:N, UI:R); browser-context execution across a trust boundary gives S:C with Low C/I and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:20 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions.

AnalysisAI

Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the Sprout Clients plugin (CPE cpe:2.3:a:boldgrid:sprout_clients) for WordPress, published by BoldGrid and used to manage and display client/portfolio information on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is emitted into HTML output without adequate output encoding or input sanitization. In a WordPress context this typically means a plugin parameter, form field, or shortcode value is rendered directly into a page, allowing HTML/JavaScript payloads to be interpreted by the browser rather than treated as inert text.

RemediationAI

No vendor-released patched version is identified at time of analysis; the affected range is stated only as 3.2.3 and earlier, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sprout-clients/vulnerability/wordpress-sprout-clients-plugin-3-2-3-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin repository for any release newer than 3.2.3 and upgrade once it is confirmed to address this CVE. Until a fix is verified, apply compensating controls: deploy a WAF or virtual patch (Patchstack provides one) to filter script payloads on the plugin's request parameters; deactivate the Sprout Clients plugin if the client-display feature is non-essential (trade-off: pages relying on it will break); and add a restrictive Content-Security-Policy header to limit inline script execution (trade-off: may break legitimate inline scripts and require tuning). Restrict access to the plugin's front-end endpoints where feasible.