What is the CVSS score of EUVD-2026-114302?

EUVD-2026-114302 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

HUSKY WordPress Plugin EUVD-2026-114302

| CVE-2026-115947 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-10-30 Patchstack

GHSA-8crx-jj58-xrc8

WordPress Information Disclosure Wordpress Plugin Husky Realmag777

6.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WordPress site over network
Exploit

Send request to HUSKY plugin endpoint
Execution

Trigger unauthenticated data exposure
Impact

Harvest sensitive information

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Exploitation Conditions	The target must be a WordPress installation running the HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 or earlier; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and unauthenticated against the plugin with no user interaction required. The available sources do NOT describe which exact feature, endpoint, or configuration triggers the exposure or what specific data is revealed, so the precise trigger is not described in the available sources. Practical limiting factors are that the site must have this specific plugin installed and activated (not a WordPress-core default), and the disclosed data per the CVSS vector is limited in scope (C:L, with low integrity impact and no availability impact).
Impact	This is a moderate-severity information-disclosure issue (CVSS 6.5) rather than a top-tier emergency. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with low complexity and no user interaction, which raises exposure, but impact is bounded: the vector lists only low confidentiality and low integrity impact (C:L/I:L) with no availability impact, consistent with CWE-201 (sensitive data exposure). No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified. The vulnerability is NOT on the CISA KEV list and no SSVC exploitation/automatable/technical-impact data was provided; the only decision signal is vuln.today's 'this_month' priority, which aligns with a serious-but-not-emergency triage. There is no confirmed active exploitation and no verified public exploit code - the sole reference is a Patchstack advisory entry, not a working PoC. Net assessment: a real, patch-this-month issue because it is network-reachable and unauthenticated, but the limited (low) confidentiality/integrity impact and absence of KEV/EPSS/PoC evidence place it below critical, actively-exploited flaws in priority.
Exploit ScenarioDerived	A remote attacker with no credentials sends crafted requests to a WordPress site running the HUSKY (Products Filter Professional for WooCommerce) plugin at version 1.4.6 or earlier and retrieves sensitive data that should not be exposed to anonymous users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. No verified public exploit code was identified in the provided sources; only a Patchstack advisory reference exists.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 30, 2026

The HUSKY plugin (Products Filter Professional for WooCommerce, vendor realmag777) at version 1.4.6 and earlier exposes sensitive data to unauthenticated remote visitors: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required to reach the exposure. The impact is rated moderate (CVSS 6.5) with limited confidentiality effect (C:L) and no availability impact, and the available sources do not specify which plugin feature, endpoint, or configuration actually triggers the disclosure or which data is revealed. Neither CISA KEV listing nor public exploit code is present in the supplied intelligence, and no EPSS score was provided, so this is tracked as a this-month remediation item rather than an emergency; exposure is limited to WordPress sites that have this specific plugin installed and active.

RemediationAI

The supplied intelligence does not identify a fixed release for this issue: no patched version number appears in the data, and the only reference is the Patchstack advisory entry (https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-4-6-sensitive-data-exposure-vulnerability), so treat that page as the authoritative tracking source and confirm the current plugin version there before planning an upgrade to whatever release Patchstack lists as fixed. Because exploitation requires the plugin to be present and active, the concrete reduction available from the supplied evidence is to deactivate and remove HUSKY on any site where the filtering functionality is not required, accepting the loss of that storefront feature; for sites that need it, inventory WordPress installs for the realmag777/husky package at 1.4.6 or below, watch the advisory for a patched build, and schedule the update within the current monthly patch cycle consistent with this item's this_month priority. No further workarounds are described in the available sources.

Affected VersionsENISA

HUSKY n/a ≤1.4.6

Affected Packages

euvd husky no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

HUSKY is a commercial WooCommerce product-filter plugin for WordPress (vendor realmag777, distributed through the woocommerce-products-filter package, CPE cpe:2.3:a:realmag777:husky), so the vulnerable surface is a WordPress plugin endpoint reachable through the site's web front end rather than a network service. The assigned weakness class is CWE-201, which describes sensitive information being placed into data the application sends to a client - that is, the disclosure happens as part of a normal response rather than through a memory-safety failure, path traversal, or injection flaw. The submitted vector and the assessed vector agree on the reachability profile (network, low attack complexity, no privileges, no user interaction), and the assessed impact is confined to confidentiality (C:L, A:N) rather than allowing code execution or service disruption. The supplied sources do not describe the request that triggers the leakage, the exact plugin version boundary beyond '1.4.6 and earlier', or the data type exposed, so the trigger is not described in the available sources and the finding should be validated against the referenced Patchstack advisory entry before assuming any particular filter, AJAX action, or REST route is involved.

Know when Husky gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI 5.3 MEDIUM

Unauthenticated remote read of sensitive data gives AV:N/AC:L/PR:N/UI:N with C:L; CWE-201 is a disclosure flaw so I set I:N/A:N absent evidence of data modification.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Prevalence

Medium

popular WooCommerce products-filter WordPress plugin, common but not universal

Social Media

Sightings

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.