What is the CVSS score of CVE-2026-57761?

CVE-2026-57761 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

SEOWP CVE-2026-57761

EUVD-2026-41316 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-02 Patchstack

GHSA-5979-4pcv-7m6g

CSRF Seowp WordPress Wordpress Theme

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network CSRF needs no attacker auth (PR:N) but requires a privileged victim to interact (UI:R); resulting stored XSS crosses trust boundary (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Jul 02, 2026 - 12:27 cve.org

HIGH 7.1

Analysis Generated

Jul 02, 2026 - 12:21 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

AnalysisAI

Stored cross-site scripting via cross-site request forgery affects the SEOWP WordPress theme by BlueAstralThemes in all versions up to and including 3.12.2, allowing a remote unauthenticated attacker who tricks a logged-in administrator into loading a malicious page to forge a state-changing request that injects persistent script into the site. The CVSS 3.1 score of 7.1 reflects a scope change (attacker-controlled JavaScript executes in the victim's browser session) with limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation hinges on successful social engineering of an authenticated victim (UI:R).

Technical ContextAI

The affected component is a commercial WordPress theme (cpe:2.3:a:blueastralthemes:seowp) that runs inside the WordPress PHP application stack. The root cause is CWE-352 (Cross-Site Request Forgery): one or more theme actions that change server-side state accept requests without validating a WordPress nonce or other anti-CSRF token, so the browser's ambient authentication cookies are sufficient to authorize the request. Because the forged action ultimately stores attacker-supplied input that is later rendered without proper output encoding, the CSRF chains into stored XSS, which is why the CVSS scope is Changed (S:C) - the injected payload crosses from the vulnerable server into the trust context of any user's browser that views the affected page.

RemediationAI

No exact vendor-released fix version is present in the provided data, so treat the fix as: upgrade the SEOWP theme to the first release published after 3.12.2 once the vendor/Patchstack advisory (https://patchstack.com/database/wordpress/theme/seowp/vulnerability/wordpress-seowp-theme-3-12-2-csrf-to-stored-xss-vulnerability) confirms a patched build. Until a patched version is confirmed, compensating controls include deploying a WordPress WAF or virtual patch (Patchstack offers one for this entry) to enforce anti-CSRF and block XSS payloads on the theme's request handlers; restricting administrative access to trusted networks/VPN and requiring admins to avoid clicking untrusted links while logged in, which reduces the UI:R trigger surface; and if the vulnerable theme feature is non-essential, disabling or replacing the theme, with the trade-off that switching themes changes site appearance and may require reconfiguration. Because the payload results in stored XSS, also review theme-managed content for already-injected scripts after patching.