What is the CVSS score of EUVD-2026-48135?

EUVD-2026-48135 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Custom Links in Elementor Image Carousel EUVD-2026-48135

| CVE-2026-65534 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-m39f-w9q9-9v38

WordPress XSS Wordpress Plugin Custom Links In Elementor Image Carousel

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Author-level account required (PR:H), victim must load the page (UI:R), impact crosses into victim browser (S:C); no direct availability impact is expected from stored XSS.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:10 vuln.today

DescriptionCVE.org

Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.

AnalysisAI

Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.

Technical ContextAI

The affected component is the Custom Links in Elementor Image Carousel WordPress plugin developed by charlie_etienne (CPE: cpe:2.3:a:charlie_etienne:custom_links_in_elementor_image_carousel:*:*:*:*:*:*:*:*). This plugin extends Elementor's native image carousel widget by allowing editors to attach custom hyperlinks to carousel images. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the plugin fails to adequately sanitize or HTML-encode attacker-controlled link values before rendering them into the page DOM. Because Elementor stores widget configurations in the WordPress database, the malicious payload persists and is served to every subsequent visitor, classifying this as a stored (persistent) XSS. The Scope:Changed metric in the CVSS vector reflects that while the injection originates from a privileged editorial action on the server, the impact is realized in a separate security boundary - the victim's browser context.

RemediationAI

Check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/custom-links-in-elementor-image-carousel/vulnerability/wordpress-custom-links-in-elementor-image-carousel-plugin-1-1-1-cross-site-scripting-xss-vulnerability for a patched release beyond version 1.1.1 - no confirmed fix version is available in the current intelligence data, so monitor for a vendor update. If no patch is available or deployment cannot be updated immediately, remove or deactivate the plugin on sites where all Author-role users are not fully trusted; this eliminates the attack surface at the cost of losing the custom link functionality. As a secondary compensating control, a WAF with XSS filtering rules (such as the Patchstack firewall or a Cloudflare managed ruleset) can reduce exploitation likelihood but does not remediate the underlying flaw and may produce false positives on legitimate link inputs. Restrict Author-role account creation to vetted individuals as an administrative policy measure.