What is the CVSS score of EUVD-2026-43475?

EUVD-2026-43475 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of GD Security Headers are affected by EUVD-2026-43475?

The GD Security Headers WordPress plugin (versions 1.8 and earlier) contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious JavaScript executed in visitors'…

How to fix or mitigate EUVD-2026-43475?

Within 24 hours, conduct a comprehensive inventory of all WordPress installations to identify those running GD Security Headers plugin versions 1.8 or earlier, including both production and development environments. Within 7 days, evaluate alternative security header solutions such as code-based header implementations, web server-native configurations, or compatible replacement plugins; document the business requirements currently met by GD Security Headers to ensure functional continuity. Within 30 days, execute migration to the selected alternative solution, including testing header functionality across all affected WordPress sites, or disable the plugin entirely if suitable replacements are not yet available and implement compensating controls until permanent migration is complete.

GD Security Headers EUVD-2026-43475

| CVE-2026-57403 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Gd Security Headers

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS needs no attacker privileges (PR:N) but requires a victim click (UI:R); script runs in a different context (S:C) with limited CIA impact, giving Low impacts.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:58 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Security Headers gd-security-headers allows Reflected XSS.This issue affects GD Security Headers: from n/a through <= 1.8.

AnalysisAI

Reflected cross-site scripting in the GD Security Headers WordPress plugin (by Milan Petrovic, versions up to and including 1.8) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they click a crafted link. The flaw stems from improper input neutralization during web page generation (CWE-79) and, per the CVSS scope-change metric, can affect resources beyond the vulnerable component. No public exploit code has been identified and it is not listed in CISA KEV, but disclosure by Patchstack makes the affected versions well documented.

Technical ContextAI

GD Security Headers is a WordPress plugin whose purpose is to manage HTTP security response headers (CSP, HSTS, X-Frame-Options, etc.) for a site. The vulnerability is a classic CWE-79 Reflected XSS: user-controlled input is echoed back into a generated page without proper output encoding or input sanitization, so an attacker-supplied value in a request parameter is reflected verbatim into the HTML/JS context. The single CPE, cpe:2.3:a:milan_petrovic:gd_security_headers:*, confirms the affected component is the plugin application itself rather than the WordPress core. Ironically the plugin exists to harden HTTP security headers, yet a strong Content-Security-Policy configured through it (or another mechanism) could itself blunt the payload.

RemediationAI

No vendor-released patch version is identified at time of analysis, so treat all versions through 1.8 as vulnerable and monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gd-security-headers/vulnerability/wordpress-gd-security-headers-plugin-1-8-cross-site-scripting-xss-vulnerability) and the plugin's WordPress.org page for a release above 1.8, applying it as soon as it is published. Until a fixed version is available, compensating controls include deactivating the GD Security Headers plugin if it is not essential (trade-off: loses whatever security-header management it provided), placing a Web Application Firewall or Patchstack virtual patch in front of the site to filter reflected-XSS payloads (trade-off: rule tuning and possible false positives), and enforcing a strict Content-Security-Policy that disallows inline script execution to reduce payload impact (trade-off: may break legitimate inline scripts and admin UI functionality). Administrators should also avoid clicking untrusted links to plugin endpoints while logged in.