{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39708", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:58:22.476Z", "datePublished": "2026-04-08T08:30:48.106Z", "dateUpdated": "2026-09-25T10:04:01.121Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-25T10:04:01.121Z"}, "title": "WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability", "datePublic": "2026-03-01T15:04:57.000Z", "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through 1.3.17.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.<p>This issue affects UiCore Elements: from n/a through 1.3.17.</p>"}]}], "affected": [{"vendor": "UiCore", "product": "UiCore Elements", "packageName": "uicore-elements", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "versions": [{"version": "0", "versionType": "custom", "status": "affected", "lessThanOrEqual": "1.3.17", "changes": [{"at": "1.3.18", "status": "unaffected"}]}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/uicore-elements/vulnerability/wordpress-uicore-elements-plugin-1-3-14-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "credits": [{"lang": "en", "value": "Abu Hurayra | Patchstack Bug Bounty Program", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "solutions": [{"lang": "en", "value": "Update the WordPress UiCore Elements plugin to the latest available version (at least 1.3.18).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress UiCore Elements plugin to the latest available version (at least 1.3.18)."}]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T13:18:56.855529Z", "id": "CVE-2026-39708", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:19:03.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39708", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T13:18:56.855529Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T13:18:40.321Z"}}], "cna": {"tags": ["x_open-source"], "title": "WordPress UiCore Elements plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Abu Hurayra | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "UiCore", "product": "UiCore Elements", "versions": [{"status": "affected", "changes": [{"at": "1.3.18", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.17"}], "packageName": "uicore-elements", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress UiCore Elements plugin to the latest available version (at least 1.3.18).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress UiCore Elements plugin to the latest available version (at least 1.3.18).", "base64": false}]}], "datePublic": "2026-03-01T15:04:57.000Z", "references": [{"url": "https://patchstack.com/database/wordpress/plugin/uicore-elements/vulnerability/wordpress-uicore-elements-plugin-1-3-14-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through 1.3.17.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.<p>This issue affects UiCore Elements: from n/a through 1.3.17.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-09-25T10:04:01.121Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39708", "state": "PUBLISHED", "dateUpdated": "2026-09-25T10:04:01.121Z", "dateReserved": "2026-04-07T10:58:22.476Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:48.106Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "uicore-elements", "product": "UiCore Elements", "vendor": "UiCore", "versions": [{"changes": [{"at": "1.3.18", "status": "unaffected"}], "lessThanOrEqual": "1.3.17", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UiCore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through 1.3.17."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') en uicore UiCore Elements uicore-elements permite XSS Almacenado. Este problema afecta a UiCore Elements: desde n/a hasta <= 1.3.14."}], "id": "CVE-2026-39708", "lastModified": "2026-09-25T10:17:07.943", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39708", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T13:18:56.855529Z", "version": "2.0.3"}}]}, "published": "2026-04-08T09:16:43.620", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/uicore-elements/vulnerability/wordpress-uicore-elements-plugin-1-3-14-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.14]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}]}, "product": "uicore_elements", "vendor": "uicore"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T15:23:01.151203+00:00", "value": {"mitigation_remediation": ["Upgrade the UiCore Elements plugin to the latest version (>= 1.3.15).", "Verify that all stored content has not been corrupted, and delete or sanitize any entries containing injected scripts. If an upgrade is not immediately possible, disable or uninstall the plugin until the vulnerability is addressed. Monitor the site for suspicious activity and review access logs for unauthorized data modifications."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting in UiCore Elements plugin that can lead to client\u2011side script execution, cookie theft, phishing, or defacement."}, "threat_synthesis": {"affected_systems": "The issue applies to the WordPress UiCore Elements plugin by the vendor uicore, affecting all releases up to and including version 1.3.14. No pre\u20111.3.14 versions were patched already. Any WordPress installation that uses this plugin version is vulnerable.", "description_and_impact": "The plugin stores user\u2011supplied content without proper sanitization, enabling stored XSS attacks. This allows an attacker to inject malicious JavaScript into stored data that is later rendered, leading to client\u2011side code execution, session hijacking or site defacement. The flaw is a typical cross\u2011site scripting weakness (CWE\u201179). This vulnerability can affect any user who visits a page that displays the injected content, potentially compromising confidentiality, integrity and availability of the affected site.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity. EPSS is less than 1%, so exploitation is considered unlikely at present, and the weakness has not been catalogued by CISA's KEV list. Exploitation requires the attacker to insert malicious payloads into the plugin\u2019s stored content \u2013 typically through the plugin\u2019s content editor or any interface that accepts HTML input. Since the payload is stored, once an authorized or anonymous user views the affected page, the injected script runs in the victim\u2019s browser. The impact is limited to the client side, so no direct server compromise is achieved unless the attacker can leverage other vulnerabilities."}}}}, "created": "2026-04-08T19:40:09.787275+00:00", "updated": "2026-04-09T08:21:57.928098+00:00", "vendors": ["uicore", "uicore$PRODUCT$uicore_elements", "wordpress", "wordpress$PRODUCT$wordpress"]}