What is the CVSS score of EUVD-2026-39740?

EUVD-2026-39740 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-39740?

Yes, a patch is available for EUVD-2026-39740. Update the affected software to the latest version immediately.

SeedProd Pro EUVD-2026-39740

Q: Which versions of SeedProd Pro are affected by EUVD-2026-39740?

Stored Cross-Site Scripting in SeedProd Pro WordPress plugin (versions below 6.19.5) allows an authenticated Contributor-level user to inject malicious JavaScript that executes in the context of…. A patch is available.

| CVE-2026-57617 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-9499-25wc-w6pm

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor auth required (PR:L), victim must view page (UI:R), scope changes to victim browser (S:C); availability impact assessed as None since XSS does not disrupt service.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:17 vuln.today

Patch available

Jun 26, 2026 - 16:01 EUVD

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

AnalysisAI

Stored Cross-Site Scripting in SeedProd Pro WordPress plugin (versions below 6.19.5) allows an authenticated Contributor-level user to inject malicious JavaScript that executes in the context of other users' browsers, including administrators. The changed scope (S:C) in the CVSS vector confirms the impact crosses from the plugin's trust boundary into victims' browser sessions, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing is identified at time of analysis, but patch availability is confirmed by the vendor via Patchstack.

Technical ContextAI

SeedProd Pro is a premium WordPress plugin for building landing pages, coming-soon screens, and maintenance-mode overlays. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied content submitted by Contributor-role accounts is not adequately sanitized or escaped before being rendered in the browser. WordPress's Contributor role is a low-privilege account type that can draft and submit content but cannot publish independently - however, the vulnerability demonstrates that even draft-stage or rendered page content can be a vector for persistent XSS payloads. The CVSS scope change (S:C) is characteristic of stored XSS where the injected payload executes in a different security context from where it was introduced.

RemediationAI

Upgrade SeedProd Pro to version 6.19.5 or later, which contains the vendor-released patch per Patchstack advisory. Site administrators should apply the update immediately via the WordPress plugin manager (Plugins > Installed Plugins > SeedProd > Update). If immediate upgrading is not possible, the primary compensating control is to remove or demote any Contributor-role accounts that are not strictly necessary, since the vulnerability requires Contributor-level authentication. Additionally, a Web Application Firewall (WAF) rule filtering XSS payloads in POST body content can reduce but not eliminate risk - note that WAF bypasses are common and this is not a substitute for patching. Review recently submitted Contributor content for suspicious script tags as a forensic step.