CVE-2026-39708
Stored XSS in UiCore Elements ≤ 1.3.14 Allows Persistent Script Injection
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uicore | ui_core_elements | to 1.3.14 (inc) |
| uicore | elements | From 1.0.0 (inc) to 1.3.14 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-39708 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-39708 is a Cross Site Scripting (XSS) vulnerability in the WordPress UiCore Elements Plugin versions up to and including 1.3.14.
This vulnerability allows attackers to inject malicious scripts, such as redirects, advertisements, or other HTML payloads, into affected websites. These scripts execute when visitors access the site.
Exploitation requires a user with at least Contributor or Developer privileges to perform an action like clicking a malicious link, visiting a crafted page, or submitting a form, meaning user interaction is necessary.
How can this vulnerability impact me? :
The vulnerability can lead to attackers injecting malicious scripts into your website, which can execute when visitors access the site.
- These scripts could redirect users to malicious sites.
- They could display unwanted advertisements.
- They could execute other harmful HTML payloads.
Exploitation requires user interaction from someone with Contributor or Developer privileges, which limits the attack vector but still poses a moderate risk.
Currently, no official patch is available, so mitigation involves updating the plugin once a patch is released or seeking help from hosting providers or web developers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Stored Cross Site Scripting (XSS) issue in the UiCore Elements WordPress plugin up to version 1.3.14. Detection typically involves checking for the presence of the vulnerable plugin version and monitoring for suspicious script injections in web pages generated by the plugin.
Since the vulnerability requires user interaction and involves injection of malicious scripts, detection can include scanning web content for unexpected or suspicious HTML or JavaScript payloads.
No specific commands are provided in the available resources, but general detection steps could include:
- Checking the installed version of the UiCore Elements plugin to see if it is version 1.3.14 or earlier.
- Using web vulnerability scanners that detect XSS vulnerabilities on your website.
- Manually inspecting web pages generated by the plugin for injected scripts or unusual HTML content.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include:
- Monitor and restrict user roles to limit who can contribute or develop content, as exploitation requires at least Contributor or Developer privileges.
- Seek assistance from hosting providers or web developers to implement temporary protective measures.
- Update the UiCore Elements plugin to a patched version once it becomes available.
Currently, no official patch is available, so limiting user privileges and monitoring for suspicious activity are key interim steps.