What is the CVSS score of EUVD-2026-39702?

EUVD-2026-39702 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Gutenverse Form are affected by EUVD-2026-39702?

The Gutenverse Form WordPress plugin (versions 2.4.7 and earlier) contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts executing within…

How to fix or mitigate EUVD-2026-39702?

Within 24 hours: Inventory all WordPress installations to identify Gutenverse Form plugin presence and installed versions. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking script injection patterns in form parameters; restrict form functionality to authenticated users only if operationally feasible; disable the plugin if not mission-critical. Within 30 days: Monitor vendor security advisories for patch availability; maintain and test WAF rulesets blocking known XSS vectors in form inputs.

Gutenverse Form EUVD-2026-39702

| CVE-2026-56040 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-4vr7-2w2q-jv5q

WordPress XSS Wordpress Plugin

7.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered unauthenticated XSS (AV:N/PR:N) needing victim click (UI:R); injected script crosses into the user's session (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:03 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.

AnalysisAI

Cross-site scripting in the Gutenverse Form WordPress plugin (versions ≤ 2.4.7) lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim interacts with a crafted link or page. The CVSS:3.1 score is 7.1 with a changed scope, reflecting that injected script crosses the trust boundary into the user's authenticated WordPress session. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is Gutenverse Form, a Gutenberg-block form-builder plugin for WordPress that renders user-supplied input within page output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled data is reflected or stored into HTML/JavaScript context without adequate output encoding or input sanitization. In the WordPress plugin context, such flaws typically arise where form fields, query parameters, or block attributes are echoed back into the DOM. The changed scope (S:C) in the CVSS vector indicates the executing script affects a security context beyond the vulnerable component itself - i.e., the browser session of the WordPress user/admin rather than just the plugin.

RemediationAI

No vendor-released patch version was identified in the provided data - the input names only the vulnerable range (≤ 2.4.7) and does not cite a fixed release. Administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gutenverse-form/vulnerability/wordpress-gutenverse-form-plugin-2-4-7-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org page for an updated release beyond 2.4.7 and upgrade as soon as one is available. Until a confirmed patched version is installed, compensating controls include deploying a WordPress application firewall or virtual patch (Patchstack itself offers vPatch coverage) to filter XSS payloads targeting the plugin's form endpoints; restricting or disabling the Gutenverse Form plugin if it is not business-critical (side effect: forms built with it stop functioning); and adding a restrictive Content-Security-Policy header to limit inline-script execution (side effect: may break other legitimate inline scripts and require tuning). Avoid clicking untrusted links pointing at the affected site to reduce the UI:R trigger.