What is the CVSS score of EUVD-2026-93237?

EUVD-2026-93237 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of SUMO Affiliates Pro are affected by EUVD-2026-93237?

A high-severity cross-site scripting flaw in the WordPress plugin SUMO Affiliates Pro, affecting versions 11.7.0 and earlier, allows an unauthenticated attacker to inject malicious scripts into pages…

How to fix or mitigate EUVD-2026-93237?

Within 24 hours, inventory all WordPress installations running SUMO Affiliates Pro 11.7.0 or earlier, confirm exposure of the affiliate-facing pages to the public internet, and contact the plugin vendor for a remediation timeline; where the plugin is not business-critical, deactivate and remove it, and where it must remain live, deploy WAF or reverse-proxy rules that filter script tags and event-handler attributes in request parameters and block reflected payload patterns, while enforcing Content Security Policy headers and HttpOnly/SameSite cookie flags to reduce session theft impact. Within 7 days, apply virtual patching at the edge for all affected endpoints, review web and WAF logs for injected script patterns or anomalous affiliate-related requests, validate that no administrator or customer sessions were compromised, and brief site owners and the affiliate program team on the risk so they avoid clicking untrusted affiliate links. Within 30 days, re-test all instances once SUMO Affiliates Pro publishes a fixed version above 11.7.0 and upgrade immediately, or migrate affiliate functionality to a maintained alternative and formally retire the vulnerable plugin; document the interim controls, residual risk acceptance, and the verification evidence in the vulnerability register.

SUMO Affiliates Pro EUVD-2026-93237

| CVE-2026-32575 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-06 Patchstack

GHSA-2563-mp24-9vpf

WordPress XSS Sumo Affiliates Pro Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated (PR:N) network XSS needing victim interaction (UI:R) with a scope change (S:C) into the browser; low confidentiality/integrity impact and no genuine availability impact for XSS (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Oct 06, 2026 - 09:33 vuln.today

CVE Published

Oct 06, 2026 - 08:34 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

AnalysisAI

Unauthenticated cross-site scripting in SUMO Affiliates Pro 11.7.0 and earlier allows remote attackers to inject malicious scripts into pages viewed by site users because the WordPress plugin does not properly neutralize user-controllable input (CWE-79). Exploitation requires the victim to load or interact with a crafted payload (UI:R), but no attacker authentication is needed (PR:N); the flaw is network-reachable and can alter browser-side scope (S:C). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to deliver a crafted payload that a victim must then load or interact with (UI:R in the vector), since XSS executes in the victim's browser rather than firing automatically against the server. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) scores 7.1 (High) and describes a network-reachable, unauthenticated (PR:N) cross-site scripting flaw that requires user interaction (UI:R) and causes a scope change (S:C), consistent with CWE-79 XSS crossing the browser security boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch status is not confirmed by the provided references and no exact fixed version is listed; check the Patchstack advisory for a vendor-released update and apply it as soon as it is available, validating the installed version of SUMO Affiliates Pro afterward. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations running SUMO Affiliates Pro 11.7.0 or earlier, confirm exposure of the affiliate-facing pages to the public internet, and contact the plugin vendor for a remediation timeline; where the plugin is not business-critical, deactivate and remove it, and where it must remain live, deploy WAF or reverse-proxy rules that filter script tags and event-handler attributes in request parameters and block reflected payload patterns, while enforcing Content Security Policy headers and HttpOnly/SameSite cookie flags to reduce session theft impact. …

Threat intelligence, references, and detailed analysis are available after sign-in.