What is the CVSS score of EUVD-2026-48178?

EUVD-2026-48178 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Breakdance are affected by EUVD-2026-48178?

The Breakdance WordPress page-builder plugin (versions ≤2.7.1) contains a cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts that execute in users'…

How to fix or mitigate EUVD-2026-48178?

Within 24 hours, audit all WordPress instances to identify Breakdance plugin installations running version 2.7.1 or earlier and classify each by business criticality. Within 7 days, deploy Web Application Firewall (WAF) rules to detect and block XSS payloads, implement strict Content Security Policy headers to prevent inline script execution, deactivate Breakdance on non-critical sites, and establish monitoring of soflyy advisories for patch releases. Within 30 days, prepare rapid deployment procedures for version 2.7.2+ upon availability, conduct comprehensive audit of WordPress administrator accounts for unauthorized access indicators, and evaluate alternative page-builder solutions as contingency.

Breakdance EUVD-2026-48178

| CVE-2026-57735 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-836f-pccp-m4hv

WordPress XSS Wordpress Plugin Breakdance Soflyy

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS (PR:N, AV:N, AC:L) needs victim interaction (UI:R); script runs in the trusted site context (S:C) with low confidentiality/integrity impact and no genuine availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:22 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.

AnalysisAI

Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

Breakdance is a visual drag-and-drop page builder plugin for WordPress used to construct site pages, templates, and dynamic content without code. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-supplied data is reflected or stored into rendered HTML without adequate output encoding or input sanitization, allowing browser-side script execution. The affected component is identified by CPE cpe:2.3:a:soflyy:breakdance:*:*:*:*:*:*:*:*, covering the plugin as distributed for WordPress. Because the CVSS vector marks scope as changed (S:C), the injected script can affect resources beyond the vulnerable component's own security authority - typical of XSS where code runs in the trusted context of the WordPress site as viewed by the victim (e.g., an authenticated administrator's session).

RemediationAI

No vendor-released patch version is identified in the provided data; the '<= 2.7.1' affected range implies remediation lies in a version newer than 2.7.1, so administrators should check the Breakdance/soflyy changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/breakdance/vulnerability/wordpress-breakdance-plugin-2-7-1-cross-site-scripting-xss-vulnerability) and upgrade to the first release above 2.7.1 once confirmed. Until a patched version is verified and applied, compensating controls include deploying a WordPress-aware Web Application Firewall (Patchstack itself offers virtual patching) to filter XSS payloads, restricting access to the affected plugin endpoints, and enabling a strict Content-Security-Policy to constrain inline script execution - noting that a tight CSP can break legitimate page-builder functionality that relies on inline scripts and should be tested in staging. Advise administrators to avoid clicking untrusted links to their own site while logged in, since exploitation depends on user interaction.