What is the CVSS score of EUVD-2026-39726?

EUVD-2026-39726 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

SureCart EUVD-2026-39726

| CVE-2026-57313 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-w82j-fffr-xp84

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Subscriber account required (PR:L), victim must view injected content (UI:R), scope changes to admin context (S:C); XSS does not credibly cause availability impact so A:N.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:19 vuln.today

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.

AnalysisAI

Stored Cross-Site Scripting in SureCart WordPress plugin versions up to and including 4.2.2 allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The 'Subscriber' designation in the CVE title confirms exploitation requires only a low-privilege WordPress account, lowering the barrier to attack significantly for sites with open registration. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

SureCart is a WordPress e-commerce plugin providing checkout, subscription, and payment management functionality. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) signals a Stored or DOM-based XSS variant - injected payload persists server-side and executes in the security context of other users (e.g., administrators) who later view affected pages, rather than a self-reflected attack. The affected CPE maps to the WordPress plugin ecosystem ('SureCart <= 4.2.2'), as confirmed by the Patchstack advisory reference.

RemediationAI

The primary fix is to upgrade SureCart to a version above 4.2.2. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/surecart/vulnerability/wordpress-surecart-plugin-4-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve should confirm the exact patched release version, which was not independently verifiable from the provided data. Upstream fix availability has not been explicitly confirmed in the input - treat the patch as 'available per vendor advisory' pending verification. As a compensating control for sites unable to update immediately, disabling subscriber-level registration (Dashboard > Settings > General > Membership) removes the low-privilege attack surface; this trade-off blocks new public registrations. Additionally, deploying a WordPress WAF rule targeting XSS payloads in SureCart form fields (available via Patchstack Firewall or Wordfence) can block exploitation attempts without requiring a plugin update.