What is the CVSS score of EUVD-2026-44886?

EUVD-2026-44886 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Breakdance are affected by EUVD-2026-44886?

Breakdance WordPress page-builder plugin (versions through 2.7.1) contains a stored code-injection vulnerability that permits unauthenticated attackers to inject malicious scripts into website…

How to fix or mitigate EUVD-2026-44886?

Within 24 hours, perform asset discovery to identify all WordPress installations using Breakdance version 2.7.1 or earlier; immediately quarantine any pages suspected of compromise from public access. Within 7 days, audit affected pages for suspicious injections in fields parameter, deploy WAF rules to restrict or monitor fields parameter submissions, and disable the Breakdance plugin on non-critical sites until patched. Within 30 days, establish monitoring for Breakdance vendor patch release (watch for version 2.7.2+), prepare and validate a staged upgrade plan, and implement organization-wide Content Security Policy headers with script-src 'self' to mitigate inline script execution risks.

Breakdance EUVD-2026-44886

| CVE-2026-7543 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-7xfg-8mc3-f3f7

WordPress XSS Breakdance

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network injection (PR:N/AV:N) per description, no interaction to store; scope change (S:C) as script runs in victim browser context with low confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:01 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

HIGH 7.2

DescriptionCVE.org

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Breakdance WordPress page-builder plugin (versions through 2.7.1) lets unauthenticated attackers inject persistent JavaScript through the 'fields' parameter, which then runs in the browser of any user who views the affected page. The flaw carries a CVSS 3.1 score of 7.2, elevated by a scope change (S:C) because the payload executes in visitors' browser sessions rather than the server context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Wordfence discovered and reported it.

Technical ContextAI

Breakdance is a commercial visual page-builder plugin for WordPress that renders site content and dynamic form/element fields. The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: attacker-controlled input passed via the 'fields' parameter is neither sanitized on input nor escaped on output, so raw HTML/JavaScript is stored and later reflected verbatim into rendered pages. The affected component is identified by CPE cpe:2.3:a:breakdance:breakdance:*:*:*:*:*:*:*:* covering all builds up to and including 2.7.1. Because the payload is stored server-side and executed in every visitor's browser, this is a persistent (stored) XSS rather than a reflected one, giving it broader reach.

RemediationAI

Vendor-released patch: 2.7.2 - upgrade the Breakdance plugin to version 2.7.2 or later, per the vendor security update at https://breakdance.com/breakdance-2-7-2-security-update/. If an immediate upgrade is not possible, deploy a WAF rule (for example via Wordfence, per https://www.wordfence.com/threat-intel/vulnerabilities/id/64f07bca-5d04-4b28-b775-f47ed692575e?source=cve) to filter script-bearing input to the 'fields' parameter, and restrict or audit access to pages and endpoints that accept Breakdance field input; note that aggressive WAF filtering of the 'fields' parameter can break legitimate rich content and should be tested. Also review existing pages for already-injected payloads, since stored XSS persists after patching, and rotate/review any administrator sessions if injection is suspected.