What is the CVSS score of CVE-2026-66474?

CVE-2026-66474 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Insert Headers And Footers Code Ht Script CVE-2026-66474

EUVD-2026-49249 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-27 Patchstack

GHSA-w4v3-r7xf-6jph

CSRF Insert Headers And Footers Code Ht Script

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:01 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code - HT Script <= 1.1.8 versions.

AnalysisAI

Cross-Site Request Forgery in the HT Script WordPress plugin allows an attacker to trick an authenticated administrator into performing unintentional actions, such as modifying the header/footer code that may include injecting malicious scripts. Versions 1.1.8 and earlier are affected. No public exploit or active exploitation has been identified at this time.