CVE-2026-39708
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The UiCore Elements plugin for WordPress (versions up to and including 1.3.14) contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during page generation. An attacker can inject a malicious script that executes in other users' browsers.
Risk Assessment
An attacker can steal session cookies, redirect users to malicious sites, or perform other actions in the victim's context, compromising data security.
Recommendation
Update the UiCore Elements plugin to version 1.3.15 or later if available; otherwise, remove or disable the plugin.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uicore UiCore Elements uicore-elements allows Stored XSS.This issue affects UiCore Elements: from n/a through <= 1.3.14.