What is the CVSS score of EUVD-2026-43403?

EUVD-2026-43403 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of CWS SVGicons are affected by EUVD-2026-43403?

The CreativeWS CWS SVGicons WordPress plugin (versions ≤1.5.5) contains an authenticated SQL injection vulnerability that allows low-privileged WordPress users to extract sensitive data from your…

How to fix or mitigate EUVD-2026-43403?

Within 24 hours, disable and deactivate the CWS SVGicons plugin on all WordPress instances. Within 7 days, audit WordPress access logs for suspicious database queries from low-privilege accounts and review which users hold contributor-level or higher permissions; revoke unnecessary elevated access. Within 30 days, procure and deploy an actively maintained alternative for SVG icon management that has undergone vendor security review.

CWS SVGicons EUVD-2026-43403

| CVE-2026-57787 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Cws Svgicons Creativews

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable blind SQLi needing a low-privileged account (PR:L); scope change (S:C) as injection reaches core WordPress tables, high read impact, no integrity change.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:34 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.

AnalysisAI

Authenticated blind SQL injection in the CreativeWS CWS SVGicons WordPress plugin (all versions up to and including 1.5.5) allows a low-privileged authenticated user to inject crafted SQL into a database query, per a Patchstack advisory. Because the CVSS vector reports a scope change with high confidentiality impact, a successful attack can read data beyond the plugin's own tables, exposing the broader WordPress database. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is CWS SVGicons, a WordPress plugin (CPE cpe:2.3:a:creativews:cws_svgicons) that adds SVG icon functionality to WordPress sites. The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command, meaning user-controlled input is concatenated into a SQL statement without proper parameterization or escaping. The 'blind' qualifier indicates the query results are not returned directly in the response, so an attacker infers data through boolean or time-based inference. Running inside WordPress, the plugin shares the site database (wp_ tables), so injection can reach WordPress core tables including wp_users and wp_options.

RemediationAI

No vendor-released patch version is identified in the available data, so no exact fix version can be cited. Because the input lists affected versions only through 1.5.5 without a fixed release, monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/cws-svgicons/vulnerability/wordpress-cws-svgicons-plugin-1-5-5-sql-injection-vulnerability) and the WordPress plugin repository for an update newer than 1.5.5 and apply it once published. As compensating controls until a patch is confirmed: deactivate and remove the CWS SVGicons plugin if it is not essential (side effect: loss of SVG icon functionality on the site); place a WAF rule in front of WordPress to block SQL injection patterns on the plugin's request parameters (side effect: possible false positives on legitimate input); and tighten account provisioning to reduce the pool of low-privileged accounts an attacker could abuse, since exploitation requires authentication. Also restrict database user permissions for WordPress to the minimum required to limit the blast radius of any injection.