What is the CVSS score of CVE-2026-57762?

CVE-2026-57762 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Simple URLs CVE-2026-57762

EUVD-2026-41317 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-q8gg-w774-849h

WordPress XSS Wordpress Plugin Simple Urls

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Author credentials required (PR:H), admin must view content (UI:R), scope change to admin context confirmed; availability impact not substantiated for standard stored XSS.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:29 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions.

AnalysisAI

Stored Cross-Site Scripting in the Simple URLs WordPress plugin (versions <= 151) allows authenticated author-level users to inject persistent malicious scripts into content rendered in the WordPress admin interface. The CVSS Scope:Changed metric indicates the injected payload executes in a security context beyond the attacker's own session - most likely the administrative dashboard viewed by higher-privileged users such as site administrators. No public exploit code or active exploitation confirmed at time of analysis, but the scope change introduces a realistic privilege escalation path from author to administrator via session hijacking.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a failure to sanitize or encode user-supplied input before rendering it in an HTML context. The Simple URLs plugin by Andrew Fiebert (CPE: cpe:2.3:a:andrew_fiebert:simple_urls) is a WordPress plugin used to manage custom URL shortlinks and pretty-print redirects. The XSS vector is described as 'Author' level, indicating the vulnerable input surface is an author-accessible field - likely a URL label, title, or slug field - whose value is stored in the database and later rendered without encoding in the admin UI. The CVSS S:C (Scope Changed) metric confirms the payload executes outside the attacker's own browsing context, consistent with stored XSS surfacing in an administrator's session.

RemediationAI

Update the Simple URLs plugin to a version newer than 151 via the WordPress plugin dashboard or by checking the WordPress.org plugin repository for the latest release. Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simple-urls/vulnerability/wordpress-simple-urls-plugin-151-cross-site-scripting-xss-vulnerability for the confirmed patched version number, which is not independently specified in the available input data. If an immediate update is not possible, restrict author-level role assignment to only fully trusted users, as the exploit requires author credentials - revoking or auditing author accounts eliminates the primary attack path. Additionally, enabling a WordPress security plugin with XSS output filtering (e.g., Patchstack, Wordfence) can serve as a compensating control, though it does not address the root cause and may not block all payload variants.