What is the CVSS score of EUVD-2026-49719?

EUVD-2026-49719 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

News Theme V8 EUVD-2026-49719

| CVE-2026-8167 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-28 iletisim@usom.gov.tr

GHSA-hvjw-m798-2765

XSS

6.1

CVSS 3.1 · Vendor: usom

Severity by source

Vendor (usom) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Reflected XSS with user interaction (UI:R) and scope change due to cross-origin script execution; limited integrity and confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (usom).

CVSS VectorVendor: usom

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 09:33 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS.

This issue affects News Theme V8: through 16.06.2026.

AnalysisAI

Reflected cross-site scripting in the News Theme V8 WordPress theme by THEWP Digital Solutions up to version 16.06.2026 allows unauthenticated remote attackers to inject and execute arbitrary web script in a victim's browser. A user clicking a maliciously crafted link can lead to session hijacking, content spoofing, or redirection to harmful sites. No active exploitation or public exploit code has been identified.

Technical ContextAI

This is a classic web application vulnerability rooted in CWE-79: improper neutralization of input during web page generation. The News Theme V8 theme for WordPress fails to sufficiently sanitize user-supplied data that is reflected back in HTTP responses, enabling the injection of JavaScript payloads. While CPE is not formally listed, EUVD confirms the affected component is a PHP-based WordPress theme typically invoked via URL parameters or form submissions. The reflected XSS arises because unsanitized input is included in page markup without proper output encoding.

RemediationAI

No patch version is explicitly stated in the advisory. Users should consult the vendor advisory for an updated version and upgrade immediately. As a temporary workaround, deploy a web application firewall rule to block typical XSS payloads, and ensure output encoding is applied to any user-controllable reflection point in the theme. Disabling or replacing the vulnerable theme will fully block the attack vector, though this may alter site appearance. Rely on the vendor update and the advisory link for definitive fix guidance.