What is the CVSS score of CVE-2026-6370?

CVE-2026-6370 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Mini Ajax Cart For Woocommerce CVE-2026-6370

EUVD-2026-22981 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Patchstack

WordPress XSS Mini Ajax Cart For Woocommerce Wordpress Plugin Hashthemes

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:30 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 16:30 euvd

EUVD-2026-22981

CVE Published

Apr 15, 2026 - 16:02 nvd

MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

AnalysisAI

Stored cross-site scripting (XSS) in Mini Ajax Cart for WooCommerce up to version 1.3.4 allows authenticated administrators to inject malicious scripts into pages. When other users view these pages, the scripts execute, potentially leading to session theft or defacement. No active exploitation reported (CISA KEV not listed, SSVC exploitation none); EPSS score very low (0.03%).