What is the CVSS score of CVE-2026-66467?

CVE-2026-66467 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

FluentCommunity CVE-2026-66467

EUVD-2026-57886 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-13 Patchstack

GHSA-4rc5-2q8r-3mf5

WordPress XSS Wordpress Plugin Fluentcommunity Wpmanageninja

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by subscriber role requirement; A:N substituted for A:L as XSS does not credibly cause availability impact per available description.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:14 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions.

AnalysisAI

Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.

Technical ContextAI

FluentCommunity is a WordPress community-building plugin developed by WP Manage Ninja (CPE: cpe:2.3:a:wpmanageninja:fluentcommunity:*:*:*:*:*:*:*:*). CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input from subscriber-level accounts is not adequately sanitized or escaped before being rendered in the browser. The PR:L designation in the CVSS vector pinpoints the 'Subscriber' WordPress role - the lowest registered user role - as the privilege tier sufficient to trigger injection. The S:C (Scope Changed) metric confirms the vulnerability crosses trust boundaries: a subscriber injects content that executes in the browser session of a distinct, higher-privileged user such as an administrator. This is a classic stored or reflected XSS pattern common in WordPress plugin community or forum features where user-generated content is displayed to other users.

RemediationAI

Update FluentCommunity to a version above 2.7.5 - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/fluent-community/vulnerability/wordpress-fluentcommunity-plugin-2-7-5-cross-site-scripting-xss-vulnerability should be consulted to confirm the exact patched release version, which is not independently confirmed in the available data. As compensating controls pending a patch, disable open user registration to prevent unauthenticated parties from obtaining subscriber accounts, since PR:L exploitation requires an attacker-controlled account. Additionally, restrict which user roles can post or interact with community content fields that render HTML; many WordPress community plugins expose role-based content permissions. Implementing a Web Application Firewall (WAF) with XSS filtering rules (e.g., Wordfence or Cloudflare WAF) can reduce exploitation risk but is not a substitute for patching, as WAF rules can be bypassed. Reviewing and hardening Content Security Policy (CSP) headers to restrict inline script execution is an effective supplementary control with low operational impact.