What is the CVSS score of EUVD-2026-24698?

EUVD-2026-24698 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Buzz Comments EUVD-2026-24698

| CVE-2026-6041 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24698

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.4

DescriptionCVE.org

The Buzz Comments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom Buzz Avatar' (buzz_comments_avatar_image) setting in all versions up to, and including, 0.9.4. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the plugin settings page.

AnalysisAI

Stored cross-site scripting in the Buzz Comments WordPress plugin (all versions up to 0.9.4) allows authenticated administrators to inject arbitrary JavaScript via the 'Custom Buzz Avatar' setting, with the malicious script executing whenever any user accesses the plugin settings page. The vulnerability requires high-privilege administrative access and manual interaction with the settings interface, limiting its practical exploitability to insider threats or compromised administrator accounts.

Technical ContextAI

The Buzz Comments plugin is a WordPress plugin (CPE: cpe:2.3:a:mixer2:buzz_comments:*:*:*:*:*:*:*:*) that manages user comments and avatars. The vulnerability is a classic CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the 'buzz_comments_avatar_image' setting parameter. The plugin fails to sanitize user input when storing the custom avatar image URL and fails to properly escape output when rendering this value on the admin settings page (admin.tpl.php line 36 and buzzComments_class.php line 187). This allows an administrator to store malicious JavaScript payload in the database, which is then reflected and executed in the browser context of any user (including other administrators and site maintainers) who views the plugin settings page.

RemediationAI

Update the Buzz Comments plugin to a patched version beyond 0.9.4 as released by the plugin developer; exact patched version number not specified in provided references, so check the WordPress.org plugin page or Wordfence advisory for the latest stable release. The fix should include proper input sanitization of the 'buzz_comments_avatar_image' setting using WordPress sanitization functions (e.g., sanitize_text_field() or esc_url()) and output escaping using esc_url() or esc_attr() when rendering the avatar URL in admin.tpl.php. Until a patch is available, administrators should restrict access to the plugin settings page to trusted users only, audit any existing custom avatar settings for injected scripts, and consider temporarily disabling the custom avatar feature by removing or commenting out the relevant input field in admin.tpl.php. Additionally, implement WordPress security hardening such as strong passwords, two-factor authentication for administrator accounts, and regular security audits to reduce the risk of administrator account compromise.