What is the CVSS score of EUVD-2026-20838?

EUVD-2026-20838 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-20838

| CVE-2026-3574 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 Wordfence

GHSA-7mrh-c2jm-p6fw

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 03:30 euvd

EUVD-2026-20838

Analysis Generated

Apr 09, 2026 - 03:30 vuln.today

CVE Published

Apr 09, 2026 - 02:25 nvd

MEDIUM 4.4

DescriptionCVE.org

The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's settings fields (including 'Navigation Font Size', 'Navigation Font Weight', 'Heading Font Size', 'Heading Font Weight', 'Text Font Size', and 'Text Font Weight') in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in Experto Dashboard for WooCommerce plugin versions up to 1.0.4 allows authenticated administrators to inject arbitrary JavaScript into plugin settings fields (Navigation Font Size, Font Weight, Heading Font Size, Font Weight, Text Font Size, and Font Weight) due to missing input sanitization and output escaping. The injected scripts execute when any user accesses the settings page, affecting only multi-site WordPress installations or single-site installations with unfiltered_html disabled. No public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability stems from improper use of WordPress Settings API in the Experto Dashboard plugin. Specifically, the register_setting() function lacks a sanitize_callback parameter to validate and clean user-supplied input before storage, and the field rendering callback (field_callback()) fails to apply esc_attr() when outputting stored values in HTML attributes via printf(). This is a classic Stored XSS pattern where untrusted data persists in the WordPress options table and is later rendered without encoding. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected CPE is cpe:2.3:a:uxdexperts:experto_dashboard_for_woocommerce:*:*:*:*:*:*:*:* covering all versions through 1.0.4. The vulnerability only manifests in multi-site WordPress installations or where the unfiltered_html capability has been explicitly disabled, as these configurations prevent administrators from bypassing XSS protections.

RemediationAI

Update the Experto Dashboard for WooCommerce plugin to a version newer than 1.0.4 (exact patched version not confirmed in available advisory data; check WordPress Plugin Repository or Wordfence for latest release). The remediation requires adding a sanitize_callback to register_setting() to strip HTML/JavaScript from user input (e.g., sanitize_text_field() for font size/weight fields) and applying esc_attr() to all printf output statements in field_callback() functions that render stored option values into HTML attributes. Organizations unable to immediately update should restrict administrative access to the plugin settings page to trusted users only and review recent changes to font-related settings for injected code. For detailed remediation guidance, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a070f19e-9f65-499d-87c0-65be12d4be84?source=cve and the WordPress Plugin Repository changeset references provided in the advisory.