What is the CVSS score of CVE-2026-65533?

CVE-2026-65533 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Smart SEO Tool CVE-2026-65533

EUVD-2026-48134 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-3qm6-rv2x-967h

WordPress XSS Wordpress Plugin Smart Seo Tool Wbolt Com

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication is required (PR:L), victim must view the payload (UI:R), scope changes to victim's browser (S:C); availability impact on the server is not a realistic outcome of this XSS class.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:11 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.

AnalysisAI

Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.

Technical ContextAI

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), indicating that user-supplied input processed by the Smart SEO Tool plugin is not adequately sanitized or escaped before being rendered in the browser. The affected product is the Smart SEO Tool plugin for WordPress developed by wbolt.com (CPE: cpe:2.3:a:wbolt.com:smart_seo_tool:*:*:*:*:*:*:*:*), in all versions through 4.1.2. The WordPress Contributor role can create and submit posts but cannot publish them without review, meaning a malicious payload could persist in draft or pending content and detonate when an editor or administrator reviews it - a typical stored XSS exploitation pathway in WordPress plugin contexts.

RemediationAI

Update the Smart SEO Tool plugin to a version above 4.1.2 per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/smart-seo-tool/vulnerability/wordpress-smart-seo-tool-plugin-4-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve); note that the exact patched version number is not independently confirmed from the available data and should be verified in the WordPress plugin repository or vendor release notes. As a compensating control, immediately audit which users hold the Contributor role and revoke it from any untrusted or externally registered accounts - this directly eliminates the attack vector since PR:L is a hard prerequisite. Deploying a Web Application Firewall with XSS filtering rules (such as Patchstack's virtual patching, Wordfence, or Sucuri) can block payload delivery at the perimeter while a plugin update is staged. Implementing a strict Content-Security-Policy header that disallows inline scripts is a durable architectural mitigation, though it requires testing for compatibility with other site functionality. Deactivating the plugin entirely until a verified patched release is available is the most conservative option, trading SEO automation capability for risk elimination.