What is the CVSS score of EUVD-2026-43474?

EUVD-2026-43474 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Flexible Refund Plugin EUVD-2026-43474

| CVE-2026-57402 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Flexible Refund And Return Order For Woocommerce Wpdesk

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

Stored XSS requires low-privilege auth (PR:L) and admin view (UI:R); scope changes to admin browser (S:C), but availability impact is not applicable to standard XSS.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:26 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible Refund and Return Order for WooCommerce flexible-refund-and-return-order-for-woocommerce allows Stored XSS.This issue affects Flexible Refund and Return Order for WooCommerce: from n/a through <= 1.0.51.

AnalysisAI

Stored cross-site scripting in the wpdesk Flexible Refund and Return Order for WooCommerce plugin (versions through 1.0.51) allows authenticated low-privileged users - such as registered WooCommerce customers - to inject persistent malicious scripts that execute in the browsers of other users, including administrators who review refund submissions. The scope-changed CVSS vector (S:C) confirms impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions against shop owners. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the Flexible Refund and Return Order for WooCommerce WordPress plugin by wpdesk (CPE: cpe:2.3:a:wpdesk:flexible_refund_and_return_order_for_woocommerce:*:*:*:*:*:*:*:*), a plugin extending WooCommerce to handle customer-initiated refund and return order workflows. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as failure to sanitize or properly encode user-supplied input before storing it and subsequently rendering it in the WordPress admin interface. The stored XSS variant is particularly high-impact in WooCommerce environments because refund submissions flow directly into the admin dashboard, which administrators access as part of normal order management workflow. The S:C (Scope Changed) metric in the provided CVSS vector confirms that injected scripts execute in the victim administrator's browser security context rather than the attacker's, enabling cross-origin impact.

RemediationAI

Upgrade the Flexible Refund and Return Order for WooCommerce plugin to a version above 1.0.51 - consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/flexible-refund-and-return-order-for-woocommerce/vulnerability/wordpress-flexible-refund-and-return-order-for-woocommerce-plugin-1-0-51-cross-site-scripting-xss-vulnerability and the WordPress Plugin Directory to confirm the exact patched release, as no specific fix version was included in the available data. If immediate upgrade is not possible, temporarily deactivating the plugin eliminates the attack surface at the cost of losing refund and return order functionality. As a secondary compensating control, a web application firewall rule blocking common XSS patterns (script tags, event handlers, javascript: URI schemes) in form fields processed by the plugin can reduce risk, though WAF bypasses for stored XSS are well-documented and this should not substitute for patching. Restricting customer registration to known users on the WooCommerce store raises the bar for exploitation but is operationally disruptive for public storefronts.