What is the CVSS score of CVE-2026-57764?

CVE-2026-57764 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Yoast SEO Breadcrumb Shortcode CVE-2026-57764

EUVD-2026-41319 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-7xv8-5jwr-q8vr

WordPress XSS Wordpress Plugin Surbma Yoast Seo Breadcrumb Shortcode Surbma

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication required (PR:L); scope changes to victim's browser context (S:C); no credible availability impact from XSS alone, so A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:28 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Surbma | Yoast SEO Breadcrumb Shortcode <= 1.2 versions.

AnalysisAI

Stored Cross-Site Scripting in the Surbma Yoast SEO Breadcrumb Shortcode WordPress plugin (versions <= 1.2) allows contributor-level authenticated users to inject malicious JavaScript via the breadcrumb shortcode, which executes in the browser context of any victim who views the affected content - most critically a site administrator. The scope change (S:C) in the CVSS vector confirms the script escapes the plugin's own context and can hijack privileged sessions or perform unauthorized admin actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that the plugin fails to properly sanitize or escape user-controlled input before rendering it as HTML output. The affected component is a WordPress shortcode handler - specifically the breadcrumb shortcode that integrates with Yoast SEO's breadcrumb API. Shortcodes in WordPress are processed server-side and their output is injected into page HTML; if contributor-supplied shortcode attributes or post content referencing the shortcode are not sanitized, they can carry persistent JavaScript payloads. The CPE string (cpe:2.3:a:surbma:surbma_|_yoast_seo_breadcrumb_shortcode:*:*:*:*:*:*:*:*) covers all versions up to and including 1.2 with no platform restriction, meaning any WordPress installation running this plugin is within scope.

RemediationAI

Upstream fix availability is not independently confirmed from the provided data - no exact patched version number is included in the intelligence. Site operators should check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/surbma-yoast-breadcrumb-shortcode/vulnerability/wordpress-surbma-yoast-seo-breadcrumb-shortcode-plugin-1-2-cross-site-scripting-xss-vulnerability for any released update beyond version 1.2. If no patch is yet available, the primary compensating control is to remove or deactivate the plugin entirely, eliminating the vulnerable shortcode from the page-rendering pipeline. Alternatively, restrict the WordPress Contributor role to only fully trusted internal users, accepting the trade-off that this limits content creation flexibility. Enabling a Web Application Firewall rule targeting stored XSS payloads (e.g., via Wordfence or Patchstack's own virtual patching feature) provides an additional layer but should not substitute for patching.