What is the CVSS score of CVE-2026-57651?

CVE-2026-57651 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Ghost Kit CVE-2026-57651

EUVD-2026-39766 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-m7v9-h4q3-64mg

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth required (PR:L), admin must view content (UI:R), scope changes to victim browser (S:C); XSS carries no direct availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:10 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

AnalysisAI

Cross-site scripting in the Ghost Kit WordPress plugin (versions ≤ 3.6.0) allows authenticated Contributor-level users to inject and store malicious JavaScript payloads via plugin block fields or parameters. When a higher-privileged user - such as an editor or administrator - views the affected content, the attacker's script executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No CISA KEV listing or public exploit has been identified at time of analysis; however, the CVSS scope-change indicator (S:C) reflects meaningful cross-user impact that can translate to full site compromise if an admin session is hijacked.

Technical ContextAI

Ghost Kit is a WordPress plugin extending the Gutenberg block editor with additional custom blocks, layouts, and utilities. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning one or more Ghost Kit block attributes or editor fields fail to properly sanitize or escape user-supplied input before rendering it in the browser. WordPress Contributors can author and submit content but lack administrative rights; by embedding unsanitized script payloads in affected Ghost Kit fields, a Contributor can persist malicious JavaScript that fires in the browser of any privileged user who subsequently views that content. The affected product is confirmed as Ghost Kit versions up to and including 3.6.0, as recorded in EUVD-2026-39766. No CPE string was supplied in the available intelligence data.

RemediationAI

Site administrators should update the Ghost Kit plugin to the latest available version via the WordPress plugin repository, verifying the installed version exceeds 3.6.0. A confirmed exact patched version number was not present in the available intelligence data - the Patchstack advisory at the referenced URL should be consulted directly to confirm the minimum safe release. As a compensating control prior to patching, restrict Contributor-level role assignments to fully trusted users only, since exploitation requires an active Contributor account; this significantly reduces attack surface without disabling the plugin entirely. If contributor registration is open or uncontrolled, temporarily deactivating the Ghost Kit plugin is the most effective short-term mitigation, though it will disable associated blocks and layouts site-wide. There are no known workarounds that preserve full plugin functionality while neutralizing the XSS vector.