CVSS (Common Vulnerability Scoring System) is published and maintained by FIRST, the Forum of Incident Response and Security Teams. It expresses a vulnerability's severity in a comparable way, whatever vendor or database publishes it. It is the number shown next to almost every CVE ID: “9.8 critical,” “6.4 medium.”
How the score is calculated
The base score isn't a judgment call: it follows from a handful of metrics, each with a small number of possible values. In version 3.1, still the most widespread, they are:
- Attack Vector (AV): network, adjacent, local or physical. A WordPress plugin vulnerability is almost always “network.”
- Attack Complexity (AC): low or high.
- Privileges Required (PR): none, low (a subscriber account, for example) or high.
- User Interaction (UI): none or required (an administrator has to click a link).
- Scope (S): unchanged, or changed if the attack reaches beyond the vulnerable component.
- Impact on confidentiality, integrity and availability (C, I, A): none, low or high.
These values form a readable vector string. The LiteSpeed Cache flaw CVE-2024-28000, an unauthenticated privilege escalation, is rated 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network attack, low complexity, no privileges or interaction, maximum impact. The analysis of the 2024 LiteSpeed Cache vulnerabilities shows what this vector means in practice.
| Score | Severity |
|---|---|
| 0.0 | None |
| 0.1 to 3.9 | Low |
| 4.0 to 6.9 | Medium |
| 7.0 to 8.9 | High |
| 9.0 to 10.0 | Critical |
CVSS 3.1 and CVSS 4.0
Version 4.0, released by FIRST on November 1, 2023, keeps the same scale but reworks the metrics. It adds Attack Requirements (AT), replaces Scope with a distinction between impact on the vulnerable system (VC, VI, VA) and on subsequent systems (SC, SI, SA), and renames the Temporal group to Threat. It also introduces a nomenclature that states what the score includes: CVSS-B for the base only, CVSS-BT with threat, CVSS-BE with environmental metrics, CVSS-BTE with all three.
What the score doesn't tell you
The specification is clear: the base score measures a vulnerability's intrinsic severity, not the risk to your organization. It doesn't know whether the flaw is already being exploited (a zero-day vulnerability can have a medium score and do far more damage than a critical flaw nobody targets), nor whether your site meets the attack conditions.
For WordPress: prioritizing updates
- Look at
PR:Nfirst: a flaw exploitable without an account is the one bots target most. - With
PR:L, ask yourself whether your site accepts registrations: without subscriber or customer accounts, the risk drops considerably. - With
UI:R, the flaw requires a user to click: administrator vigilance matters. - A vulnerability reported as exploited comes before all others, whatever its score.
WP Masquerade Pro's alerts on vulnerable plugins show the severity of each known vulnerability along with the fixed version, which makes this triage possible at a glance. To go further, the monitoring method and decision tree explain what to do depending on severity.