What is the CVSS score of CVE-2026-57737?

CVE-2026-57737 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Phlox Theme Plugin CVE-2026-57737

EUVD-2026-41105 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 Patchstack

GHSA-gjh6-v8v4-8hv9

WordPress XSS Shortcodes And Extra Features For Phlox Theme Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L reflects required contributor-level WordPress auth; A:N because DOM XSS does not impact service availability; remaining metrics align with network-delivered, scope-changing XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:25 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS.

This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.16.

AnalysisAI

DOM-Based XSS in the Shortcodes and extra features for Phlox theme WordPress plugin (all versions through 2.17.16) permits a low-privileged authenticated attacker to inject malicious JavaScript that executes in victims' browsers via unsanitized shortcode input. Exploitation requires an attacker with at least contributor-level WordPress access and a privileged user to view the crafted page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit identified at time of analysis; vulnerability was disclosed by Patchstack and is not listed in CISA KEV.

Technical ContextAI

The affected product is the auxin-elements WordPress plugin (Shortcodes and extra features for Phlox theme) by Averta LTD, identified by CPE cpe:2.3:a:averta_ltd:shortcodes_and_extra_features_for_phlox_theme covering all versions through 2.17.16. CWE-79 (Improper Neutralization of Input During Web Page Generation) pinpoints the root cause as insufficient sanitization or escaping of user-controlled data before it is written to the browser DOM. The DOM-Based variant means the vulnerable execution path is client-side: attacker-supplied shortcode attributes or parameters are processed and injected into the DOM by JavaScript rather than being reflected directly from the server response, making server-side output encoding alone insufficient as a control. This class of flaw commonly arises when jQuery-based shortcode renderers write user input via innerHTML or document.write without encoding.

RemediationAI

Administrators should update the auxin-elements plugin to a version beyond 2.17.16 - the exact patched release version is not independently confirmed in available data and must be verified via the WordPress plugin repository (wordpress.org/plugins/auxin-elements) or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/auxin-elements/vulnerability/wordpress-shortcodes-and-extra-features-for-phlox-theme-plugin-2-17-16-cross-site-scripting-xss-vulnerability before deploying. As a compensating control pending patch verification, restrict WordPress roles below Editor from creating or editing content that uses plugin shortcodes, since the attack requires low-privileged content submission (PR:L); removing contributor or author roles for untrusted users closes the injection vector without disabling the plugin. Alternatively, temporarily deactivating the auxin-elements plugin eliminates the vulnerable code path at the cost of losing Phlox shortcode rendering. A WAF rule targeting DOM XSS patterns in shortcode parameter inputs may reduce risk but does not address the root cause and carries a risk of false positives on legitimate shortcode usage.