What is the CVSS score of EUVD-2026-39745?

EUVD-2026-39745 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

StatCounter WordPress Plugin EUVD-2026-39745

| CVE-2026-57629 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-26 audit@patchstack.com

GHSA-xm6v-vxpj-38gq

WordPress XSS Wordpress Plugin

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.5 MEDIUM

Contributor-level authentication (PR:L), victim interaction required to trigger payload (UI:R), and scope change (S:C) reflect cross-session impact on administrator-level users.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:15 vuln.today

DescriptionCVE.org

Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

AnalysisAI

Cross-site scripting in the StatCounter WordPress plugin (versions up to and including 2.1.1) allows authenticated Contributor-level users to inject persistent malicious scripts into content that executes in the browser context of higher-privileged users who view that content. The CVSS scope change (S:C) indicates the payload can reach sessions beyond the attacker's own - most critically Administrator sessions - enabling session hijacking, credential theft, or unauthorized administrative actions such as creating backdoor accounts. No public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).

Technical ContextAI

StatCounter is a WordPress plugin providing traffic analytics and visitor statistics. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as insufficient output encoding or input sanitization of contributor-supplied data before it is rendered in HTML responses. The CVSS vector (PR:L, UI:R, S:C) indicates this is almost certainly a stored XSS pattern: a low-privileged Contributor embeds a payload in plugin-controlled or post-content fields that are persisted to the database and later rendered to other users, including administrators. This is consistent with the 'Contributor Cross Site Scripting' designation in the CVE title. The scope change in CVSS 3.1 signals that the injected script executes in a security context separate from the attacker's own - typically the administrator's authenticated browser session.

RemediationAI

Consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/official-statcounter-plugin-for-wordpress/vulnerability/wordpress-statcounter-plugin-2-1-1-cross-site-scripting-xss-vulnerability for the latest patched release. Patch available per vendor advisory; no exact fixed version is independently confirmed from the available data - verify the current plugin version in the WordPress plugin repository and upgrade beyond 2.1.1 as soon as a patched release is confirmed. As an immediate compensating control, restrict the Contributor role exclusively to verified, trusted users and disable open user registration if it is enabled, since this eliminates the threat actor's primary access vector. Implementing a Content Security Policy (CSP) response header with a strict script-src directive will reduce the impact of any remaining XSS payloads by blocking inline script execution, though this may require testing for compatibility with legitimate plugin functionality. Audit existing Contributor-level accounts for unauthorized additions.