What is the CVSS score of CVE-2026-57684?

CVE-2026-57684 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

TheFox Theme CVE-2026-57684

EUVD-2026-41293 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-86pc-wv97-h27m

XSS Thefox WordPress Wordpress Theme

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor account required (PR:L), victim must view content (UI:R), scope changes to browser context (S:C); no direct availability impact attributable to XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:34 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in TheFox <= 3.9.70 versions.

AnalysisAI

TheFox WordPress theme by tranmautritam in versions 3.9.70 and earlier allows a Contributor-level authenticated attacker to inject persistent Cross-Site Scripting payloads into theme-specific input fields, which then execute in the browsers of any user who views the affected content. The Changed Scope (S:C) in the CVSS vector confirms the payload crosses security boundaries into the victim browser context, enabling session token theft, credential harvesting, or unauthorized administrative actions against higher-privileged users such as editors or site admins. No public proof-of-concept and no CISA KEV listing have been identified at time of analysis; the vulnerability was reported and documented by Patchstack.

Technical ContextAI

TheFox is a commercial multipurpose WordPress theme developed by tranmautritam, sold via the Envato/ThemeForest marketplace (CPE: cpe:2.3:a:tranmautritam:thefox:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating that one or more theme-specific input surfaces accessible to the WordPress Contributor role fail to properly sanitize or escape user-supplied data prior to HTML rendering. WordPress Contributors can author draft posts but typically require editorial approval before publication; this vulnerability implies theme shortcodes, custom fields, or theme-specific widgets bypass standard WordPress output escaping functions such as esc_html() or wp_kses(). The CVSS Changed Scope (S:C) metric confirms the injected script executes in a security context distinct from the server - namely the victim's browser - which is the defining characteristic of reflected or stored XSS that targets administrative sessions.

RemediationAI

Update the TheFox theme to a version released after 3.9.70 once a patched release is published by tranmautritam; check the Envato/ThemeForest marketplace or the Patchstack advisory at https://patchstack.com/database/wordpress/theme/thefox/vulnerability/wordpress-thefox-theme-3-9-70-cross-site-scripting-xss-vulnerability for patch availability, as no specific fixed version is confirmed in the available data. As an immediate compensating control, restrict the WordPress Contributor role to only fully trusted, vetted users and disable open contributor registration if enabled - this eliminates the PR:L attack prerequisite entirely, though it will impact community or multi-author publishing workflows. A Web Application Firewall with XSS virtual patching rules (available via Wordfence, Patchstack Shield, or similar WordPress security plugins) can block known XSS payload patterns in theme input fields; note that WAF rules are signatures-based and may not catch novel payload variants. If the theme is not actively in use, consider deactivating it until a patch is confirmed available.