What is the CVSS score of CVE-2026-65527?

CVE-2026-65527 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Liquid Speech Balloon CVE-2026-65527

EUVD-2026-48128 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-pmpp-x56x-f97x

WordPress XSS Wordpress Plugin Liquid Speech Balloon Lqd

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor account required (PR:L), victim must view page (UI:R), scope changes to victim browser (S:C); availability impact removed as XSS does not plausibly disrupt availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:12 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.

AnalysisAI

Stored Cross-Site Scripting in the Liquid Speech Balloon WordPress plugin (versions <= 1.2.5) allows authenticated contributors to inject malicious scripts into speech balloon elements that execute in the browser context of higher-privileged users who view the affected content. The CVSS vector confirms PR:L and S:C, meaning a low-privileged contributor account is sufficient to plant the payload, and the scope change indicates impact extends to victim sessions. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Liquid Speech Balloon is a WordPress plugin (CPE: cpe:2.3:a:lqd:liquid_speech_balloon:*:*:*:*:*:*:*:*) that renders customizable speech balloon UI components in post content. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the plugin fails to properly sanitize or escape contributor-supplied input before rendering it in HTML output. This class of stored XSS is common in WordPress plugins that allow shortcode or block editor attributes to be saved without adequate server-side escaping, which then reflects into the DOM when any user with sufficient viewing privileges loads the page.

RemediationAI

Update the Liquid Speech Balloon plugin to a version beyond 1.2.5 once a patched release is confirmed available via the WordPress plugin repository or the vendor. Patch availability per vendor advisory is indicated by the Patchstack report at https://patchstack.com/database/wordpress/plugin/liquid-speech-balloon/vulnerability/wordpress-liquid-speech-balloon-plugin-1-2-5-cross-site-scripting-xss-vulnerability - consult this source for the confirmed fixed version number before updating. If an immediate update is not possible, restrict contributor-level account creation and audit existing contributor accounts to reduce the pool of potential attackers. Disabling the Liquid Speech Balloon plugin entirely is an effective compensating control with the trade-off of losing speech balloon functionality site-wide. Implementing a Web Application Firewall rule to strip or block common XSS payloads in POST request bodies can reduce but not eliminate risk, as WAF bypass techniques exist.