What does a CVSS score of 9.8 mean for your WordPress site?

# TagsSecurityWordPress

The WPhost team14 Oct 202613 min read

A security alert about a plugin you use says "CVSS 9.8, Critical". It sounds alarming, and sometimes it really is urgent. But the score alone does not tell you whether your site is affected or how quickly to act.

This guide explains where that exact 9.8 comes from and why two databases can score the same flaw differently. By the end you will know whether to update today or at your next scheduled maintenance, and where to check.

What CVSS is and what the score measures

CVSS (Common Vulnerability Scoring System) is an open framework for rating software vulnerabilities, owned and managed by FIRST (Forum of Incident Response and Security Teams), a US-based non-profit. Scores run from 0 to 10, with the same ratings in versions 3.1 and 4.0.

Score	Rating
0.0	None
0.1 to 3.9	Low
4.0 to 6.9	Medium
7.0 to 8.9	High
9.0 to 10.0	Critical

The CVSS 3.1 user guide says the system measures the severity of a vulnerability and should not be used alone to assess risk. Whether an attacker can reach the vulnerable code on your site is a separate question, and the rest of this guide deals with it.

Why do so many plugin vulnerabilities score CVSS 9.8?

A CVSS 3.1 score is calculated from eight answers, called metrics, which a vulnerability record lists as a vector such as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That exact vector gives 9.8.

Metric	Answer	What it means
Attack Vector (AV)	Network	The attack comes over the internet.
Attack Complexity (AC)	Low	No special conditions are needed.
Privileges Required (PR)	None	The attacker needs no account on the site.
User Interaction (UI)	None	Nobody has to click or open anything.
Scope (S)	Unchanged	The assessor judges that the breach stays within the vulnerable application.
Confidentiality (C)	High	The attacker can see all the data.
Integrity (I)	High	They can change any data and files.
Availability (A)	High	They can take the site down completely.

That is the profile of a flaw that lets a visitor without an account run code on the server, for example by uploading a PHP file. The formula is fixed, so every vulnerability with these answers scores exactly 9.8. Wordfence scored the Bricksforge flaw and the two Events Calendar flaws we covered recently with exactly this vector.

In CVSS 3.1 only a changed scope (S:C), where the attack reaches beyond the vulnerable application, lifts the same answers to 10.0.

Needing a login lowers the score. According to FIRST's calculator, the same attack scores 8.8 if it needs a low-privilege account, such as a subscriber or a store customer, and 7.2 if it needs an administrator.

Why does one vulnerability have two different scores?

CVE numbers are issued by CNAs (CVE Numbering Authorities), organisations authorised by the CVE Program to publish records in their own area. Wordfence, Patchstack and WPScan are CNAs that cover WordPress, and each runs its own vulnerability database.

NVD, the database run by the US standards institute NIST, shows the score from the issuing organisation and names it as the source. NIST used to add its own score too, but since 15 April 2026 it no longer routinely does so when the CNA has supplied one. So the number in NVD usually comes from the CNA.

Take Bricksforge. Wordfence issued CVE-2026-85097 with a score of 9.8, which NVD shows without a NIST score of its own, while Patchstack shows 10.0. The vectors differ only in scope. Wordfence judged that the breach stays within the vulnerable application (S:U), and Patchstack that it reaches beyond it (S:C). Both scores are in the "Critical" band.

The version matters too. CVSS 4.0, published by FIRST on 1 November 2023, has no Scope metric and rates the impact on the vulnerable system and on other systems separately, so the same no-login attack scores 9.3 if it spares other systems. Only compare scores from the same version, shown at the start of the vector (CVSS:3.1 or CVSS:4.0).

Is your site affected?

The score is the same for every site with the plugin. Your admin and the vulnerability description show whether yours is affected.

Is the plugin installed, and which version? In Plugins > Installed Plugins, check whether your version is among the affected ones, for example "up to and including 3.1.8.9". A deactivated plugin carries less risk, but its files stay on the server, and the WordPress documentation advises deleting any plugin you do not use.
Do you use the vulnerable feature? The description often states the conditions. Both Events Calendar records score 9.8, yet both say the attack needs comments enabled on events. If you are unsure whether a feature is in use, assume it is, since one setting can switch it on.
Does the attack need a login, and which role? WPScan titles often say Unauthenticated, meaning no login, or, for example, Authenticated (Subscriber+), meaning at least a subscriber. In a WooCommerce store that is a weak barrier. If customers can create accounts, any visitor can get the Customer role, which WooCommerce describes as similar to a WordPress subscriber. The same goes if Anyone can register is ticked under Settings > General. Then treat a subscriber-level flaw as needing no login.

Is the vulnerability already being exploited?

This is the most important question, and CVSS does not answer it. Several sources do, and they do not always agree.

CISA, the US cybersecurity agency, maintains the KEV (Known Exploited Vulnerabilities) catalogue. It lists flaws that have a CVE number, reliable evidence of exploitation in the wild and a clear fix, such as an update. If your plugin is listed, update straight away. Its absence is no reassurance, though. As of 13 October 2026 the catalogue lists only three WordPress plugins, all added in 2021.

For plugins, follow Patchstack's and Wordfence's notes and the vendor's announcements. With Bricksforge, Patchstack saw the first attack on 7 October and flagged the flaw as exploited. As of 13 October it is still not in KEV.

The third signal is EPSS, a FIRST model that estimates daily the probability that a published CVE will be exploited in the next 30 days. A high probability is a reason to update at once, but a low one is no guarantee. On 13 October the EPSS for Bricksforge was under 1%, although attacks had begun six days earlier. FIRST's own guidance says EPSS does not know whether a flaw is already confirmed to be under attack, and that confirmed exploitation should take precedence over the score.

Should you update today or at your next scheduled maintenance?

Start at the top and stop at the first row that fits your case.

What you found	What to do
Reports of attacks from KEV, Patchstack, Wordfence or the vendor	Update today, whatever the score. With no fix yet, deactivate the plugin.
No login needed, or anyone can create an account on the site	Update today. With no fix yet, deactivate or replace the plugin.
An account only your own people have, such as an editor or administrator	Update at your next scheduled maintenance, and do not skip it.
The vulnerable feature is not used on the site	Update at your next scheduled maintenance. One setting can switch the feature on.
The plugin is deactivated and not needed	Delete it.

Where to look up a plugin's vulnerabilities

You can search each of these by plugin name or by CVE number.

Wordfence Intelligence is Wordfence's database, with a page for every vulnerability.
Patchstack Database shows its own patch priority next to the CVSS score, and that priority takes attacks into account.
WPScan lists vulnerabilities by plugin, and its titles often name the login and role needed.
NVD shows the CVE record, with the vector and the organisation that gave the score.
CISA's KEV catalogue can be searched by CVE number or by vendor.

If your hosting has WP Toolkit, it shows vulnerable plugins right in cPanel, as the WP Toolkit guide explains.

If your site has few plugins and you watch the alerts, the table above is enough to handle this yourself. If you would rather not make every alert your problem, vulnerability monitoring is part of our active maintenance. Every day we check your plugins, theme and WordPress against the known vulnerability (CVE) databases and update them in time, after testing in staging.

Checklist

I checked the version of the plugin named in the alert.
I deleted plugins that are deactivated and not needed.
I checked whether I use the vulnerable feature and whether the attack needs a login.
I looked up the CVE number in KEV and in the Patchstack and Wordfence notes.
I took a backup and, where possible, tried the update in staging first.
I checked the site for traces if the vulnerable version ran during attacks.

Frequently asked questions

What is CVSS?

CVSS (Common Vulnerability Scoring System) is an open framework for rating software vulnerabilities, owned by FIRST, a non-profit organisation. Scores run from 0 to 10, and 9.0 or more is "Critical". The CVSS 3.1 user guide says the system measures a vulnerability's severity and should not be used alone to assess risk.

What does a CVSS score of 9.8 mean?

A CVSS 3.1 score of 9.8 means an attack over the internet, with no account and no help from a user, that gives full control of the site. It is the profile of a flaw that lets a visitor without an account run code on the server, for example by uploading a PHP file. The formula is fixed, so every vulnerability with the same answers to the eight metrics scores exactly 9.8.

Why do so many plugin vulnerabilities score 9.8?

Because many plugin flaws share the same profile, an attack over the internet with no login and no user action, giving full access to the data and files. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H always gives 9.8. If the attack needs a low-privilege account, such as a subscriber or a store customer, the same attack scores 8.8, and if it needs an administrator, 7.2.

Why does one vulnerability have different scores in different databases?

CVE numbers are issued by organisations (CNAs) such as Wordfence, Patchstack and WPScan, each of which runs its own database and may judge the metrics differently. For Bricksforge, Wordfence gave 9.8 and Patchstack 10.0, and the only difference was the Scope metric. CVSS 4.0 has no Scope metric and scores the same no-login attack 9.3, so only compare scores from the same version, shown at the start of the vector.

Is my site affected by a vulnerability scored 9.8?

The score is the same for every site with the plugin and does not say whether yours is affected. Check under Plugins > Installed Plugins whether your version is among the affected ones, whether you use the vulnerable feature and whether the attack needs a login and which role. If you are unsure whether a feature is in use, assume it is, since one setting can switch it on.

Is a vulnerability that needs a subscriber account dangerous for a WooCommerce store?

Yes, often as much as one with no login. If customers can create accounts, any visitor can get the Customer role, which WooCommerce describes as similar to a WordPress subscriber. The same goes if Anyone can register is ticked under Settings > General, so treat a subscriber-level flaw as needing no login.

How can I tell whether a vulnerability is already being exploited?

CVSS does not answer that. The KEV catalogue of CISA, the US cybersecurity agency, lists flaws with proven exploitation, but absence from it is no reassurance, since as of 13 October 2026 it lists only three WordPress plugins. For plugins, follow Patchstack's and Wordfence's notes and the vendor's announcements, and FIRST's EPSS gives a probability of exploitation in the next 30 days that does not know about attacks already confirmed.

Should I update the plugin today or at my next maintenance?

Update today if KEV, Patchstack, Wordfence or the vendor report attacks, or if the attack needs no login or anyone can create an account on the site. If the attack needs an account only your own people have, or the vulnerable feature is not used, update at your next scheduled maintenance and do not skip it. Delete a deactivated plugin you do not need.

Sources