What is the CVSS score of EUVD-2026-49064?

EUVD-2026-49064 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for EUVD-2026-49064?

Yes, a public proof-of-concept exploit is available for EUVD-2026-49064. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for EUVD-2026-49064?

Yes, a patch is available for EUVD-2026-49064. Update the affected software to the latest version immediately.

Advanced Ads EUVD-2026-49064

| CVE-2026-10082 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-27 WPScan

GHSA-mcgc-5rwj-567v

WordPress XSS Advanced Ads Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 15:32 vuln.today

Patch available

Jul 27, 2026 - 07:01 EUVD

CVE Published

Jul 27, 2026 - 06:00 cve.org

MEDIUM 6.1

CVE Published

Jul 27, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged users.

AnalysisAI

Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.