What is the CVSS score of EUVD-2026-39739?

EUVD-2026-39739 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Featured Image EUVD-2026-39739

| CVE-2026-57431 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-gj3v-p5q9-mjxv

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Author role required (PR:L), victim must view the page (UI:R), scope changed to other users' sessions; availability impact (A:N) is not substantiated by stored XSS mechanics.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:18 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Featured Image <= 2.1 versions.

AnalysisAI

Stored Cross-Site Scripting in the Featured Image WordPress plugin (≤ 2.1) allows an authenticated Author-level user to inject malicious JavaScript via featured image metadata, which then executes in the browsers of other users - including administrators - who view the affected content. The Scope:Changed CVSS metric confirms the payload escapes the author's own session and can compromise higher-privileged accounts, making privilege escalation the primary real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause, indicating the plugin fails to sanitize or context-appropriately escape user-supplied input before rendering it in HTML output. WordPress's Featured Image mechanism allows post authors to associate thumbnail imagery and related metadata with posts; the vulnerable plugin does not apply sufficient output encoding to these fields. The CVSS Scope:Changed (S:C) metric is technically significant here - it confirms the injected payload crosses the trust boundary of the originating author session and affects other authenticated users who load the page, a hallmark of stored (persistent) XSS rather than reflected. No CPE string was supplied in the intelligence data; affected product is identified as the 'Featured Image' plugin for WordPress at version ≤ 2.1 per ENISA EUVD-2026-39739.

RemediationAI

The primary fix is to update the Featured Image plugin beyond version 2.1; however, the exact patched version number is not confirmed in the available intelligence data - only the affected ceiling (≤ 2.1) is stated. Administrators should verify the current patched release directly in the WordPress Plugin Repository or via the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/featured-image/vulnerability/wordpress-featured-image-plugin-2-1-cross-site-scripting-xss-vulnerability before updating. As a compensating control, restrict the WordPress Author role to fully trusted accounts and audit existing Author-level users for unauthorized or compromised accounts - this directly removes the PR:L attack surface. Deploying a WAF with stored XSS detection rules (e.g., Patchstack's virtual patch or similar) can reduce exploitation likelihood but does not remediate the root cause and may produce false positives on legitimate image metadata. If the plugin update is unavailable and risk is unacceptable, deactivating the Featured Image plugin eliminates the attack surface at the cost of losing plugin functionality.