What is the CVSS score of EUVD-2026-40100?

EUVD-2026-40100 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

WooCommerce Designer Pro EUVD-2026-40100

| CVE-2026-57329 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-29 Patchstack

GHSA-q34r-767v-46h6

WordPress XSS Woocommerce Designer Pro

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L confirmed by subscriber-level requirement; UI:R and S:C reflect stored XSS cross-context execution; A:N as no availability impact is demonstrated by available description.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:21 vuln.today

CVE Published

Jun 29, 2026 - 13:36 cve.org

MEDIUM 6.5

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in WooCommerce Designer Pro <= 1.9.34 versions.

AnalysisAI

Stored Cross-Site Scripting in WooCommerce Designer Pro (WordPress plugin) versions 1.9.34 and earlier allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The scope change (S:C in CVSS) indicates injected payloads can cross privilege boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the subscriber-level entry point lowers the bar for exploitation on any site permitting account registration.

Technical ContextAI

WooCommerce Designer Pro is a WordPress plugin extending WooCommerce with product design/customization capabilities. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning the plugin fails to sanitize or escape subscriber-supplied input before rendering it in HTML output. The CPE string (cpe:2.3:a:woocommerce_designer_pro:woocommerce_designer_pro:*:*:*:*:*:*:*:*) covers all plugin versions through 1.9.34. Because this is a WooCommerce extension, the affected input vectors are likely design customization fields or metadata submitted by registered shop customers (subscribers), which are subsequently rendered in the WordPress admin panel or storefront without adequate output encoding.

RemediationAI

Upgrade WooCommerce Designer Pro to a version beyond 1.9.34; per Patchstack convention the advisory URL (https://patchstack.com/database/wordpress/plugin/wc-designer-pro/vulnerability/wordpress-woocommerce-designer-pro-plugin-1-9-34-cross-site-scripting-xss-vulnerability) should confirm the exact fixed release - check the Patchstack entry and the WordPress plugin repository for the patched version before upgrading. If an immediate patch is unavailable or cannot be deployed, disable or restrict subscriber-level account registration on the WordPress site to eliminate the low-privilege entry point; note this may impact legitimate storefront functionality. Additionally, a Web Application Firewall rule blocking script injection patterns in WooCommerce designer fields can serve as a compensating control, though WAF bypasses are common for XSS and this should not substitute for patching. Remove the plugin entirely if it is not actively used.