What is the CVSS score of EUVD-2026-53914?

EUVD-2026-53914 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WooCommerce Multilingual are affected by EUVD-2026-53914?

The WooCommerce Multilingual & Multicurrency plugin (through version 5.5.6) contains a stored cross-site scripting vulnerability exploitable by subscriber-level users that enables session hijacking…

How to fix or mitigate EUVD-2026-53914?

Within 24 hours, inventory all WordPress instances running WooCommerce Multilingual & Multicurrency plugin through version 5.5.6 and temporarily disable subscriber account creation; if the plugin is non-essential, uninstall it immediately. Within 7 days, conduct a security audit of existing subscriber accounts for malicious activity, review administrator session logs for compromise indicators, and implement Web Application Firewall rules to block XSS injection payloads. Within 30 days, monitor Patchstack and official WooCommerce channels for a security patch; apply any released patch immediately and scan all stored site content for evidence of malicious JavaScript injection.

WooCommerce Multilingual EUVD-2026-53914

| CVE-2026-66711 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-wf57-jg94-8h6g

WordPress XSS Woocommerce Multilingual Multicurrency Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

5.4 MEDIUM

PR:L assigned because 'Subscriber XSS' naming indicates subscriber authentication required; A:N as availability impact is not typical for XSS without additional evidence.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:36 vuln.today

CVE Published

Aug 06, 2026 - 14:28 cve.org

HIGH 7.1

DescriptionCVE.org

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

AnalysisAI

Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.

Technical ContextAI

The affected component is the WooCommerce Multilingual & Multicurrency plugin (CPE: cpe:2.3:a:amir_helzer:woocommerce_multilingual_&_multicurrency:*:*:*:*:*:*:*:*), a WordPress plugin authored by Amir Helzer that provides multilingual and multi-currency support for WooCommerce storefronts. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input is echoed back into a rendered page without adequate sanitization or output encoding. The 'Subscriber' qualifier in Patchstack's title indicates the injection point is accessible to WordPress users holding at minimum the Subscriber role - the lowest authenticated WordPress role - implying the vulnerable input surface exists within a subscriber-accessible feature of the plugin, such as a form field, URL parameter, or frontend widget rendered in a WooCommerce multilingual context.

RemediationAI

Upgrade WooCommerce Multilingual & Multicurrency to the first version released after 5.5.6 - a patched release is implied by the Patchstack disclosure (versions above 5.5.6 should contain the fix), but an exact remediated version number is not independently confirmed in the available data; verify the current patched release against the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/woocommerce-multilingual/vulnerability/wordpress-woocommerce-multilingual-multicurrency-plugin-5-5-6-cross-site-scripting-xss-vulnerability. If immediate patching is not possible, limit subscriber-level account registration on the WordPress site, as this restricts the attacker's ability to create an account and reach the vulnerable input surface. Additionally, deploy a WordPress-aware Web Application Firewall (WAF) rule targeting XSS payloads in the plugin's input fields as a compensating control; note that WAF rules may block legitimate multilingual content submissions and require tuning.