What is the CVSS score of CVE-2026-65538?

CVE-2026-65538 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Machete CVE-2026-65538

EUVD-2026-48139 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-wjhx-5m6h-5x26

WordPress XSS Wordpress Plugin Machete

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Author role in WordPress is low-privilege (PR:L), not high; availability impact not applicable to stored XSS without DoS mechanism.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:08 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.

AnalysisAI

Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.

Technical ContextAI

Machete is a WordPress plugin developed by nilo.velez (CPE: cpe:2.3:a:nilo_velez:machete:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the 'Author' input context - meaning content contributed by Author-role WordPress users is not adequately sanitized or escaped before being rendered in the browser. WordPress Author accounts can create and publish posts but are a lower-trust role than Editor or Administrator. The CVSS vector AV:N/AC:L/PR:H/UI:R/S:C reflects a stored XSS pattern: payload is persisted server-side, requires a victim to trigger it (UI:R), and executes in the victim's browser context rather than the attacker's (S:C - scope change). The vendor assigned PR:H, though Author-level in WordPress is typically considered a low-to-medium trust role.

RemediationAI

The primary remediation is to upgrade the Machete plugin to a version above 5.2; however, no exact patched release version was independently confirmed in the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/machete/vulnerability/wordpress-machete-plugin-5-2-cross-site-scripting-xss-vulnerability and the WordPress plugin repository for the latest available release. As a compensating control, administrators should audit and restrict Author-role access to trusted contributors only, since the vulnerability is exploitable by authenticated Authors. Disabling the ability for untrusted users to publish content without editorial review limits exploitability without requiring the plugin to be active. A Web Application Firewall (WAF) with stored XSS detection rules can block injection attempts but may cause false positives on legitimate rich content. Deactivating the plugin until a confirmed patched version is available is the most reliable interim measure.