What is the CVSS score of CVE-2026-57783?

CVE-2026-57783 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Speaker WordPress Plugin CVE-2026-57783

EUVD-2026-43401 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Speaker Merkulove

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS requires low-privilege write access (PR:L) and victim page visit (UI:R); scope changes to victim browser (S:C); availability impact removed as XSS does not cause measurable service disruption.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:18 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in merkulove Speaker speaker allows Stored XSS.This issue affects Speaker: from n/a through <= 4.1.13.

AnalysisAI

Stored Cross-Site Scripting (XSS) in the merkulove Speaker WordPress plugin (versions through 4.1.13) allows an authenticated low-privilege user to inject and persistently store malicious scripts that execute in other users' browsers upon page visitation. The scope change in the CVSS vector (S:C) confirms that successful exploitation crosses the security boundary from the plugin's context into visiting users' browser sessions, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and EPSS data was not supplied, but the low attack complexity keeps this a credible risk on any WordPress site where untrusted contributors have posting privileges.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes a class of vulnerabilities where user-supplied data is embedded into HTML output without sufficient encoding or sanitization, enabling script injection. The affected product is the merkulove Speaker plugin for WordPress, identified by CPE cpe:2.3:a:merkulove:speaker:*:*:*:*:*:*:*:* covering all versions up to and including 4.1.13. Speaker is a WordPress plugin that provides text-to-speech or audio playback functionality. The stored variant of XSS means the malicious payload is persisted in the WordPress database (e.g., in a plugin setting, shortcode attribute, or post meta field) rather than reflected in a single request, making it more dangerous because every subsequent page load by any visitor triggers execution without further attacker involvement. The scope change (S:C) in the CVSS vector indicates the injected script escapes the plugin's confined context and affects the victim's full browser session.

RemediationAI

The primary remediation is to update the merkulove Speaker plugin to a version released after 4.1.13; however, the intelligence data does not specify an exact patched release version. Site administrators should check the WordPress plugin repository or the Patchstack disclosure at https://patchstack.com/database/Wordpress/Plugin/speaker/vulnerability/wordpress-speaker-plugin-4-1-13-cross-site-scripting-xss-vulnerability for the latest patched release before upgrading. If a patch is not yet available or upgrade is not immediately feasible, the most effective compensating control is to restrict access to plugin configuration and content-creation capabilities exclusively to trusted, high-privilege accounts (administrators and editors with known identities), removing any contributor or subscriber roles that have write access to Speaker-related fields. Deploying a WordPress Web Application Firewall (WAF) such as Wordfence or the Patchstack firewall can provide virtual patching to block exploitation attempts, though WAF rules are not a substitute for patching. Disabling the plugin entirely eliminates the attack surface at the cost of losing its functionality.