What is the CVSS score of CVE-2026-57704?

CVE-2026-57704 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Smart Manager are affected by CVE-2026-57704?

The Smart Manager WordPress plugin (versions through 8.90.0) contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute scripts in administrator browsers, enabling…

How to fix or mitigate CVE-2026-57704?

Within 24 hours: Inventory all WordPress instances running Smart Manager plugin version 8.90.0 or earlier and immediately disable the plugin or apply network-level protections (WAF rules blocking script injection patterns); no public exploit identified at time of analysis, but the vulnerability poses significant risk. Within 7 days: Implement enhanced monitoring for exploitation attempts and establish daily tracking of Patchstack and StoreApps advisory channels for security updates. Within 30 days: Develop and execute a remediation strategy to either upgrade to a patched version when released by StoreApps, or migrate to an alternative WordPress e-commerce solution.

Smart Manager CVE-2026-57704

EUVD-2026-48175 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-5p38-r4f3-fvpj

WordPress XSS Wordpress Plugin Smart Manager Storeapps

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network XSS (PR:N, AV:N) requiring victim interaction (UI:R); scope change (S:C) as script escapes the plugin into the wp-admin session, with limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:21 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is Smart Manager, a WooCommerce/WordPress bulk-editing and data-management plugin distributed as smart-manager-for-wp-e-commerce (vendor: storeapps). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input reaches an HTML/JS output context without adequate encoding or sanitization, so injected markup is interpreted as active script by the browser. In WordPress plugins this class typically arises from echoing request parameters or stored records into admin/list views without wp_kses/esc_html/esc_attr escaping. The CVSS scope-change flag (S:C) indicates the script executes outside the vulnerable component's privilege boundary - characteristic of XSS that runs in the wider wp-admin or site DOM.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to any Smart Manager release later than 8.90.0 as soon as StoreApps publishes one, and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/smart-manager-for-wp-e-commerce/vulnerability/wordpress-smart-manager-plugin-8-90-0-cross-site-scripting-xss-vulnerability) and the plugin's changelog for the corrected build. As compensating controls until then: deploy a WAF or Patchstack's virtual patching to filter XSS payloads on the plugin's endpoints (may cause false positives on legitimate rich-text input); restrict access to Smart Manager admin pages to trusted operators and networks to shrink the pool of potential victims (reduces convenience for legitimate managers); and consider deactivating the plugin if it is not in active use (removes bulk-edit functionality). Because exploitation requires the victim to follow a crafted request, advise administrators against clicking untrusted links while authenticated.