What is the CVSS score of EUVD-2026-15534?

EUVD-2026-15534 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Handmade Framework are affected by EUVD-2026-15534?

CVE-2026-22520 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate EUVD-2026-15534?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Handmade Framework EUVD-2026-15534

| CVE-2026-22520 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-979w-pv5p-v945

XSS Handmade Framework

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15534

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Handmade Framework handmade-framework allows Reflected XSS.This issue affects Handmade Framework: from n/a through <= 3.9.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the G5Theme Handmade Framework WordPress plugin through version 3.9, allowing attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper neutralization of user input during web page generation, classified under CWE-79. Attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers when clicked, potentially leading to session hijacking, credential theft, or malware distribution.

Technical ContextAI

The G5Theme Handmade Framework (CPE: cpe:2.3:a:g5theme:handmade_framework:*:*:*:*:*:*:*:*) is a WordPress plugin framework affected by a Reflected XSS vulnerability rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). The underlying issue involves the framework's failure to properly sanitize or escape user-supplied input before rendering it in HTML output. In Reflected XSS attacks, malicious input is passed through URL parameters or POST data and immediately reflected back to the user without proper encoding. The vulnerability affects all versions up to and including 3.9, suggesting the framework processes user input directly in template rendering or form handling without adequate output encoding mechanisms.

RemediationAI

Immediately upgrade the G5Theme Handmade Framework plugin to a version newer than 3.9, as patched versions should address the input neutralization defect. Consult the Patchstack database and the G5Theme vendor security advisories for the specific patched version number and release date. Until an upgrade is feasible, implement output encoding by enabling WordPress security plugins that enforce HTML entity encoding and content security policy (CSP) headers to prevent inline script execution. Additionally, restrict plugin access by limiting administrative user counts, disabling plugin auto-updates if they conflict with site stability, and applying Web Application Firewall (WAF) rules to detect and block common XSS payloads in query parameters. Monitor WordPress logs for suspicious URL patterns containing script tags or encoded payloads.