What is the CVSS score of EUVD-2026-48094?

EUVD-2026-48094 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

HashThemes Demo Importer EUVD-2026-48094

| CVE-2026-65483 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-f8mr-gmgv-838m

WordPress XSS Wordpress Plugin Hashthemes Demo Importer Hashthemes

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

High privilege and user interaction required; scope change reflects cross-user browser impact; no meaningful availability impact from XSS.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:21 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.

AnalysisAI

Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

The affected product is the HashThemes Demo Importer WordPress plugin (CPE: cpe:2.3:a:hashthemes:hashthemes_demo_importer:*:*:*:*:*:*:*:*), a utility that imports pre-built demo content for HashThemes WordPress themes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input - specifically in an author-related field or metadata context - is rendered back to the browser without adequate encoding or sanitization. The CVSS scope change indicator (S:C) confirms that script execution escapes the plugin's own context and affects the victim's browser environment, a hallmark of stored or reflected XSS that can reach higher-privileged users such as site administrators.

RemediationAI

Site administrators running HashThemes Demo Importer version 1.4.2 or earlier should update the plugin to the latest available version via the WordPress plugin dashboard or the official WordPress plugin repository. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/hashthemes-demo-importer/vulnerability/wordpress-hashthemes-demo-importer-plugin-1-4-2-cross-site-scripting-xss-vulnerability) should be consulted to confirm the exact patched version, as no specific fix version was independently confirmed in the available data. If an immediate update is not feasible, consider deactivating the plugin on production sites until a patch is applied, as the plugin's demo-import functionality is typically used only during initial site setup and may not be required in ongoing production environments. Restricting author-level accounts to trusted users reduces exposure, but does not eliminate the risk given that PR:H already implies elevated privilege.