EUVD-2026-96433
GHSA-jcmq-hm39-fp26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliveryDeliver link via phishing or malicious post
-
ExploitVictim browser reflects unsanitized input
-
ExecutionScript executes in victim session context
-
ImpactSteal session or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to deliver a crafted request/URL to a victim and have that victim interact with it (UI:R), so success depends on social engineering rather than silent remote compromise - this is the primary limiting factor. No authentication is required on the attacker side (PR:N), so any unauthenticated actor can craft the payload against a site running Qode Music <= 2.1.8.2. The impact is greatest when the lured victim is an authenticated administrator or logged-in user, since the injected script runs in their browser session; the specific vulnerable parameter/endpoint is not detailed in the provided data beyond the plugin itself. |
| Impact | This is a genuinely medium-tier risk rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable, low-complexity, unauthenticated flaw - attractive on paper - but the UI:R requirement means a victim must be lured into triggering the payload, which is characteristic of reflected cross-site scripting (CWE-79) rather than a wormable server-side bug. The scope change (S:C) and the low C/I/A impacts are consistent with Patchstack's standard reflected-XSS scoring, where code executes in a separate security context (the victim's browser) rather than compromising the server directly. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - there is no network-vs-local conflict here - but the practical risk is bounded by the user-interaction requirement and by the product's limited deployment footprint. Treat as a routine 'patch on next cycle' item unless the site handles sensitive sessions. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL pointing at a vulnerable Qode Music endpoint that reflects attacker-controlled input without proper encoding, then distributes it via phishing, a forum post, or a malicious ad. When a logged-in site visitor or administrator clicks the link, the injected JavaScript executes in their browser session, enabling session-cookie theft, defacement, or actions performed as the victim. No public proof-of-concept was referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Qode Music WordPress plugin versions through 2.1.8.2 contain an unauthenticated cross-site scripting (XSS) vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows a remote attack with no attacker authentication, but success depends on luring a victim into interacting with a crafted request, so social engineering is required. No public exploit or active exploitation is identified at time of analysis, and the assessed risk is medium-tier rather than top priority.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to check the Patchstack advisory and the Qode Music vendor for a fixed release and apply it as soon as one is available. If the plugin is not required, disable and remove it, accepting loss of its music functionality. If it must remain, deploy a WordPress-aware WAF or virtual patching rule that blocks script tags, event handlers, and other XSS payloads targeting the plugin; this can cause false positives and may not cover the unspecified vulnerable parameter. Enforce a Content Security Policy that disallows inline and untrusted scripts to reduce execution impact, understanding that it may break legitimate plugin features. Because exploitation requires victim interaction (UI:R), reduce social-engineering exposure by training administrators not to click untrusted links and by restricting admin session access to trusted networks, though these are compensating controls rather than a fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-79 improper neutralization of input during web page generation in Qode Music, a WordPress plugin. The CPE cpe:2.3:a:qode:qode_music:*:*:*:*:*:*:*:* identifies the Qode Music product across versions matching the affected range. The CVSS vector indicates network reachability, low attack complexity, no privileges required for the attacker, user interaction required, and changed scope with low confidentiality, integrity, and availability impact. Successful XSS executes attacker-supplied script in the browser context of a victim; the advisory does not specify the exact vulnerable parameter or endpoint, so the root cause is best described as insufficient input sanitization or output escaping in the plugin's request handling. The highest-impact scenario is when the victim is an authenticated administrator or logged-in user, because the injected script can act within that session, but the need for victim interaction keeps this medium-tier.
Know when Qode Music gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS reachable over the network with no auth (PR:N) but needing victim interaction (UI:R); payload executes in the browser's separate context (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
Executive ViewAI
Qode Music WordPress plugin versions through 2.1.8.2 expose publicly accessible sites to an unauthenticated cross-site scripting flaw that requires a victim to interact with a crafted request. With no vendor-released patch identified at time of analysis, organizations running this plugin face ongoing risk of visitor session theft, credential compromise, malicious redirects, and brand damage until they remove or mitigate the plugin. Security leadership should prioritize identifying affected sites and applying interim controls, as the business impact extends to customer trust and potential regulatory scrutiny.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or removing Qode Music plugin versions through 2.1.8.2, deploying WAF or virtual patching rules to block XSS attempts, enforcing a strict Content Security Policy, limiting administrative access, and conducting user awareness for social-engineering lures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB