What is the CVSS score of CVE-2026-65503?

CVE-2026-65503 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Ultimate Store Kit CVE-2026-65503

EUVD-2026-48113 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-x793-w58q-w9gr

WordPress XSS Wordpress Plugin Ultimate Store Kit Elementor Addons Bdthemes

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Requires authenticated Contributor access (PR:L) and victim page load (UI:R); XSS crosses scope boundary (S:C) but does not credibly cause availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:17 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.

AnalysisAI

Stored Cross-Site Scripting in the Ultimate Store Kit Elementor Addons WordPress plugin (versions <= 3.0.5) allows authenticated Contributor-level users to inject persistent malicious scripts into page content rendered for other users, including administrators. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in victims' browser sessions, enabling session hijacking, credential theft, or admin account takeover via crafted Elementor widget output. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and widespread use of Elementor-based WooCommerce stores make this a meaningful risk for multi-author WordPress deployments.

Technical ContextAI

Ultimate Store Kit is a WooCommerce-focused Elementor addon developed by bdthemes, providing store-oriented widgets for the Elementor page builder ecosystem on WordPress. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input - likely submitted through one or more Elementor widget fields accessible to Contributor-role users - is stored without adequate sanitization or output encoding and subsequently rendered in the browser of any user who views the affected page. The CPE string cpe:2.3:a:bdthemes:ultimate_store_kit_elementor_addons:*:*:*:*:*:*:*:* covers all versions up to and including 3.0.5. The S:C (Changed Scope) in the CVSS vector is characteristic of reflected or stored XSS where the injected code executes in the security context of a different principal (the victim's browser) than the one that submitted it.

RemediationAI

Update the Ultimate Store Kit Elementor Addons plugin to a version above 3.0.5 via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ultimate-store-kit/vulnerability/wordpress-ultimate-store-kit-elementor-addons-plugin-3-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve should be consulted to confirm the exact patched release version, as an independently verified fixed version number is not available in the current data set. As a compensating control pending patching, restrict the Contributor role from creating or editing content that renders Ultimate Store Kit widgets - for example, by limiting post creation to Editor-level and above users only. Note that this workaround may disrupt editorial workflows. Additionally, enabling a Web Application Firewall rule targeting XSS payloads (e.g., via Wordfence or Patchstack's virtual patching feature) can block exploitation attempts without requiring role restructuring.