What is the CVSS score of CVE-2026-65550?

CVE-2026-65550 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

WPShopmart Tabs CVE-2026-65550

EUVD-2026-48142 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-jjrp-rj5h-3gxq

WordPress XSS Wordpress Plugin Tabs Wpshopmart

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

PR:H and UI:R reflect mandatory Shop Manager authentication and victim page-load; A:N assigned because stored XSS does not cause availability impact on the vulnerable system.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:08 vuln.today

DescriptionCVE.org

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

AnalysisAI

Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input accepted by the Tabs plugin is rendered back to the browser without sufficient sanitization or output encoding. The affected product, identified by CPE cpe:2.3:a:wpshopmart:tabs:*:*:*:*:*:*:*:*, is a WordPress plugin developed by WPShopmart that provides tabbed content display functionality, commonly used in WooCommerce-enabled stores. The Shop Manager role is a built-in WooCommerce privilege tier granting broad store management capabilities but sitting below full WordPress Administrator; this role is the minimum required for exploitation (PR:H). The S:C scope change in the CVSS vector is characteristic of stored XSS, where the injected payload persists in the database and executes in the browsers of all subsequent page visitors, crossing the security context boundary from the plugin's data storage into end-user browser sessions.

RemediationAI

The primary remediation is to update the WPShopmart Tabs plugin to a version beyond 2.5; however, no exact patched release version is confirmed in the available data - administrators should check the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/tabs-responsive/vulnerability/wordpress-tabs-plugin-2-5-cross-site-scripting-xss-vulnerability for the latest fixed release before updating. As a compensating control where immediate patching is not possible, restrict the Shop Manager role to fully trusted internal personnel only, removing it from any external vendors, partners, or marketplace sellers, since exploitation requires that role. Additionally, a Web Application Firewall rule blocking common XSS payload patterns in plugin input fields can reduce exposure, though this is not a substitute for patching. Site administrators should audit existing tab content for unexpected script tags as an indicator of prior exploitation.