What is the CVSS score of EUVD-2026-39649?

EUVD-2026-39649 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Exclusive Addons Elementor EUVD-2026-39649

| CVE-2026-57620 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 Patchstack

GHSA-p8c2-86p5-3rcc

WordPress XSS Wordpress Plugin Exclusive Addons Elementor Tim Strifler

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS via authenticated contributor yields scope change and C/I impact in victim browser; no availability impact is attributable to this XSS class.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 12:20 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS.

This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.

AnalysisAI

Stored Cross-Site Scripting in the Exclusive Addons Elementor WordPress plugin (versions through 2.7.9.8) allows authenticated low-privileged users to inject persistent malicious scripts into Elementor widgets that execute in the browsers of site visitors and administrators. The scope change (S:C in the CVSS vector) indicates the injected payload escapes the attacker's context and affects other users, enabling session hijacking, credential theft, or privilege escalation to admin. No public exploit code or CISA KEV listing is identified at time of analysis, but Patchstack has disclosed the vulnerability publicly.

Technical ContextAI

The affected product is the 'Exclusive Addons for Elementor' WordPress plugin authored by Tim Strifler (CPE: cpe:2.3:a:tim_strifler:exclusive_addons_elementor:*:*:*:*:*:*:*:*), a third-party addon extending the Elementor page builder. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as failure to sanitize or escape user-supplied input before rendering it in HTML output. In the context of Elementor addons, this typically means widget settings or content fields that accept user input are stored in the WordPress database and later rendered server-side into page HTML without proper output encoding, allowing HTML/JavaScript injection to persist across page loads.

RemediationAI

The primary remediation is to update the Exclusive Addons for Elementor plugin to a version above 2.7.9.8 via the WordPress admin dashboard or WP-CLI. The exact patched version is not confirmed in the available input data; consult the Patchstack advisory at the reference URL and the WordPress plugin repository changelog to verify the minimum safe version before updating. If an update is not immediately available or deployable, a compensating control is to restrict contributor and author role registration - if the site does not require public or untrusted user registration, disabling open registration (Settings → General → Membership) eliminates the PR:L attack surface. A Web Application Firewall rule targeting stored XSS patterns in POST requests to WordPress REST or admin-ajax endpoints can add detection capability but is not a substitute for patching. Note that disabling the Exclusive Addons plugin entirely will break Elementor widgets that depend on it, requiring page reconstruction.