What is the CVSS score of EUVD-2026-39741?

EUVD-2026-39741 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Neve PRO EUVD-2026-39741

| CVE-2026-57618 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-63mv-grhv-r323

WordPress XSS Wordpress Theme

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Contributor authentication (PR:L) and victim interaction (UI:R) are confirmed prerequisites; no credible availability impact applies to stored XSS of this type.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:16 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

AnalysisAI

Cross-site scripting in the Neve PRO WordPress theme addon (versions up to and including 3.1.2) allows a contributor-level authenticated user to inject persistent malicious JavaScript that executes in the browser context of other users, including administrators. The S:C scope change in the CVSS vector confirms the payload escapes the WordPress application boundary and executes in the victim's browser session, enabling session hijacking, credential theft, or admin-level privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in the medium-priority tier despite the scope-changed impact.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates insufficient output encoding or input sanitization in one or more contributor-accessible fields within the Neve PRO theme addon for WordPress. Neve PRO is a commercial premium extension for the Neve theme, enabling additional page-builder and template features. The WordPress contributor role can create and edit posts but cannot publish - nonetheless, the vulnerable theme component apparently renders contributor-supplied data without sanitization in a context visible to higher-privileged users. The scope change (S:C) in the CVSS vector is significant: it means the injected script executes in the victim's browser JavaScript context rather than remaining isolated to the WordPress application, enabling impact on systems and sessions beyond the vulnerable site component itself. Affected product confirmed via Patchstack database as Neve PRO ≤ 3.1.2 (EUVD-2026-39741).

RemediationAI

Update the Neve PRO WordPress theme addon to a version beyond 3.1.2 as soon as one is released by the vendor (ThemeIsle). No specific patched version number was confirmed in the available data at time of analysis - consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/neve-pro-addon/vulnerability/wordpress-neve-pro-theme-3-1-2-cross-site-scripting-xss-vulnerability and the ThemeIsle changelog for the confirmed fix version. As a compensating control while awaiting a patch, restrict or disable contributor-level user registration on affected WordPress installations; this eliminates the primary attack vector without affecting site functionality for existing higher-privileged users. Additionally, deploying a web application firewall (WAF) rule targeting XSS patterns in request bodies can reduce exploitation probability, though WAF bypasses exist and this should not replace patching. Content Security Policy (CSP) headers can limit the blast radius of any injected script by restricting script execution contexts.