What is the CVSS score of CVE-2026-57763?

CVE-2026-57763 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Structured Content CVE-2026-57763

EUVD-2026-41318 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-xmfw-955c-7j22

WordPress XSS Structured Content Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor account required (PR:L), victim must render content (UI:R), scope change reflects cross-context browser execution (S:C); availability impact removed as XSS does not affect service availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:29 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Structured Content <= 1.7.0 versions.

AnalysisAI

Cross-site scripting in the Structured Content WordPress plugin (versions <= 1.7.0) allows a Contributor-level authenticated user to inject malicious JavaScript that executes in the browser of higher-privileged users who subsequently view the crafted content. The CVSS scope change (S:C) confirms the payload crosses into the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions within a WordPress installation. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The Structured Content plugin for WordPress (CPE: cpe:2.3:a:gordon_böhme:structured_content:*:*:*:*:*:*:*:*) is developed by Gordon Böhme and provides structured content authoring functionality within the WordPress CMS. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), indicating that user-supplied input submitted by a Contributor role is not properly sanitized or escaped before being rendered in subsequent page loads. The S:C scope change in the CVSS 3.1 vector is consistent with stored XSS behavior: content authored in one security context (Contributor session) is later rendered in a distinct, higher-privileged context (administrator or editor browser session), allowing the injected script to inherit the victim's session authority.

RemediationAI

Update the Structured Content plugin to a version above 1.7.0 per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/structured-content/vulnerability/wordpress-structured-content-plugin-1-7-0-cross-site-scripting-xss-vulnerability?_s_id=cve); however, a specific confirmed patched release version is not independently verified from available data - check the WordPress plugin repository directly before upgrading to confirm a patched release exists. As an immediate compensating control, restrict the Contributor role to fully trusted and verified users only, since exploitation is gated on Contributor account access - removing unnecessary Contributor assignments eliminates the attack surface entirely without affecting site functionality for administrators and editors. If a confirmed patched version is unavailable, temporarily deactivating the plugin removes all exposure at the cost of losing Structured Content authoring functionality until a fix is released.