What is the CVSS score of CVE-2026-57650?

CVE-2026-57650 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Magazine Blocks CVE-2026-57650

Q: Which versions of Magazine Blocks are affected by CVE-2026-57650?

Stored Cross-Site Scripting in the Magazine Blocks WordPress plugin (versions ≤ 1.8.3) allows authenticated contributors to inject persistent malicious JavaScript into page content.

EUVD-2026-39765 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-32p4-hwpj-mqvq

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by Contributor-role requirement; UI:R for victim page view; S:C for XSS browser boundary; A:N because XSS does not cause meaningful availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:10 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

AnalysisAI

Stored Cross-Site Scripting in the Magazine Blocks WordPress plugin (versions ≤ 1.8.3) allows authenticated contributors to inject persistent malicious JavaScript into page content. Because the vulnerability carries a scope change (S:C in CVSS), successful exploitation targets the browsers of higher-privileged users - typically editors or administrators - who view the affected content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) covers failures to sanitize or encode user-supplied HTML/JavaScript before rendering it in a browser. Magazine Blocks is a Gutenberg-compatible WordPress plugin that provides block-based layout elements for magazine-style content. The Contributor role in WordPress can draft and submit posts but cannot publish without editorial review; however, because the plugin likely stores raw block attributes without adequate output encoding, a contributor-authored block can embed executable script that fires when any privileged user renders or previews the post. The scope change (S:C) reflects the canonical XSS trust-boundary crossing: input is accepted in the WordPress application context but executes in a victim user's browser context.

RemediationAI

Update the Magazine Blocks plugin beyond version 1.8.3; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/magazine-blocks/vulnerability/wordpress-magazine-blocks-plugin-1-8-3-cross-site-scripting-xss-vulnerability) should be consulted for the confirmed patched release version, which was not independently specified in the available intelligence. If an immediate update is not possible, restrict the Contributor role: remove or suspend contributor-level accounts that are not fully trusted, or temporarily set WordPress to require admin approval before any contributor content renders publicly. Enabling a Content Security Policy (CSP) header that blocks inline script execution is an additional compensating control but may break legitimate plugin functionality and requires testing. Note that no exact patched version number was confirmed in the provided data - verify the fix version directly from the WordPress plugin repository or the Patchstack advisory before deploying.