A CVSS score is a 0.0 to 10.0 rating of how severe a security flaw could be, and the short code that comes with it, the vector string, is the part worth reading. The vector tells you whether an attacker needs a login, whether anyone has to click, and what they could reach.
Our guide to what a CVE is introduced CVSS alongside EPSS and the CISA KEV catalog. This post goes deeper on one skill: reading a CVSS score and its vector, piece by piece, in both versions you will see in WordPress and Drupal advisories. The examples are real vectors from flaws we have covered.
The short version: read the vector before the number. Attack Vector, Privileges Required and User Interaction tell you who can reach the flaw. Check which version and which groups went into the score, since v4.0 labels them CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE. Expect scorers to disagree. And no CVSS score knows whether attacks have started or whether your site is exposed.
What goes into a CVSS score
FIRST, the Forum of Incident Response and Security Teams, maintains CVSS. Version 3.1 and version 4.0 both group their questions into sets.
| Group | v3.1 name | v4.0 name | Who usually sets it |
|---|---|---|---|
| The flaw itself | Base | Base | The vendor or CNA |
| Exploitation over time | Temporal | Threat | Advisory writers or you |
| Your setup | Environmental | Environmental | You |
| Extra context, no effect on score | None | Supplemental | The vendor |
The v4.0 specification says the organization maintaining the vulnerable system provides base metrics, and consumer organizations specify threat and environmental ones. The v3.1 specification assigns temporal values to bulletin analysts instead.
In practice, almost every CVSS score in a plugin advisory is a base score. It assumes a reasonable worst case and knows nothing about your site.
Reading a v3.1 vector: the Bricksforge flaw
Our Bricksforge post covered CVE-2026-85097, an unauthenticated file upload in a WordPress add-on. Wordfence, the CNA, scored it 9.8. The NVD record carries this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The prefix names the version. Each pair after it is one metric and its value.
| Code | Metric | Value | What it means for a site owner |
|---|---|---|---|
| AV:N | Attack Vector | Network | Reachable over the internet |
| AC:L | Attack Complexity | Low | No special conditions to line up |
| PR:N | Privileges Required | None | No login needed |
| UI:N | User Interaction | None | Nobody has to click anything |
| S:U | Scope | Unchanged | Impact stays within the vulnerable component’s security boundary |
| C:H / I:H / A:H | Confidentiality, Integrity, Availability | High, High, High | An attacker can read, change or break everything the component touches |
The first four metrics ask who can reach the flaw. AV:N with PR:N and UI:N is the worst case for a public website. The last three ask about impact, the ideas in our CIA triad primer.
Why Patchstack’s CVSS score was 10.0
Patchstack lists the same flaw at 10. Its database page does not show a vector, so we cannot see its exact choices.
Under v3.1, the highest possible score with Scope Unchanged is 9.8. Reaching 10.0 requires Scope Changed, meaning the flaw lets an attacker affect resources beyond the vulnerable component’s own security boundary. If Patchstack’s 10 is a v3.1 score, it made that call. Wordfence did not.
Scope causes a lot of disagreement in v3.1. FIRST’s v3.1 user guide gives cross-site scripting as a common Scope Changed case, because a flaw in a web application affects visitors’ browsers.
For Bricksforge, both readings land in Critical. The disagreement does not change what you do: patch today.
Reading a v4.0 vector: WordPress core CVE-2026-87902
WordPress 7.1.2 fixed CVE-2026-87902, a flaw that can lead to remote code execution without a login. Our WordPress 7.1.3 post flagged it. The WordPress security advisory scores it 9.2, Critical, with this vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Three things are new compared with v3.1.
- AT:P, Attack Requirements: Present. The attack depends on specific deployment and execution conditions. The advisory says RCE needs preconditions in both the server environment and the active theme.
- VC, VI, VA. Impact on the vulnerable system: here, high on all three.
- SC, SI, SA. Impact on subsequent systems, anything outside the vulnerable system. Here, none. This pair replaces v3.1’s Scope metric.
The NVD record for the same CVE carries a v3.1 score of 8.1, High. Its vector puts the preconditions into Attack Complexity: High. Version 4.0 keeps complexity Low and records the preconditions as AT:P instead.
Same bug, one score High and one Critical. Neither number changed the right action. CISA added CVE-2026-87902 to its KEV catalog on September 25, 2026, three days after the fix shipped.
CVSS-B, CVSS-BT, CVSS-BE, CVSS-BTE: which CVSS score is this?
Version 4.0 asks publishers to label what went into a number. The spec says the labels should be used wherever a numerical CVSS value is displayed.
- CVSS-B: base metrics only.
- CVSS-BT: base plus threat.
- CVSS-BE: base plus environmental.
- CVSS-BTE: all three.
The label matters because of one default. The threat metric, Exploit Maturity, takes Attacked, Proof-of-Concept or Unreported. If it is left as Not Defined, the spec treats it as Attacked for scoring. So a plain CVSS-B score already assumes the worst about exploitation. Setting Exploit Maturity can only hold the score or bring it down.
Version 3.1 temporal metrics work the same way: they can only lower the score.
The GlobalProtect flaw from our ransomware post shows a CVSS-BT score in use. Palo Alto Networks scored it 7.8 with E:A, Attacked. Its vector rates vulnerable-system impact low and subsequent-system confidentiality and integrity high. Our reading: the gateway loses little, and the network behind it is exposed.
The vector ends with supplemental metrics, including U:Red, the spec’s highest provider urgency. Supplemental metrics never change the score. That is how a 7.8 High arrives marked with the vendor’s highest urgency.
Severity bands and where they mislead
Both versions map a CVSS score to the same bands: None is 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0.
Bands help with sorting but break down at the edges. An 8.9 and a 9.0 sit in different bands. CVE-2026-87902 moved from High to Critical between versions with no change in the bug.
Vendors also use their own labels. Red Hat rates the Ghostscript flaw Moderate while its CVSS score of 7.8 falls in the High band. Drupal uses its own 25-point scale, covered below.
A low band is not a safe band either. Our post on package registry security covers a medium-severity SSRF that led to 41 production servers.
Why two scorers rate the same bug differently
The clearest case is Ghostscript CVE-2026-39919, from our PDF upload post. VulnCheck, the CNA, scored it 9.8 under v3.1. Red Hat scored it 7.8.
Compare the vectors:
- VulnCheck:
AV:N/AC:L/PR:N/UI:N - Red Hat:
AV:L/AC:L/PR:N/UI:R
The impact values match. The disagreement is about reachability. Red Hat treats it as local with user interaction, because someone has to process a crafted PDF. VulnCheck treats it as a network attack.
Both have support in FIRST’s v3.1 user guide. One section says document parsing flaws should typically be scored Local, however the file is delivered. Another says a library that handles incoming data should be scored for the reasonable worst-case implementation, assuming Network.
Red Hat’s page adds that scores for open source components depend on vendor-specific factors, such as version or build chain.
Your job is to pick the vector that matches your site. A CMS that turns public PDF uploads into thumbnails with no human in the loop fits VulnCheck’s reading.
What a CVSS score leaves out
The v3.1 user guide is direct about this. It says CVSS is designed to measure the severity of a vulnerability and should not be used alone to assess risk.
Exploitation. A base CVSS score is the same the day a flaw is disclosed and the day mass attacks start. Patchstack saw automated attacks on Bricksforge from October 7, 2026, the day before the CVE record was published. Check exploitation sources separately.
Your exposure. The score assumes you run the vulnerable code with the feature reachable. It does not know your version or whether the vulnerable form is public.
You can fold your setup back in with environmental metrics. In v4.0, the security requirements for confidentiality, integrity and availability default to High when not set. Lowering them for a brochure site with no member data lowers the score. Modified base metrics, such as a modified Privileges Required for an endpoint behind single sign-on, can move it either way. FIRST’s v4.0 calculator shows the effect.
Scores on our examples as of October 2026
These are the scores we read on October 21, 2026, from NVD records, vendor advisories and the pages linked above. Scores and statuses change, so check the live record.
| CVE (our post) | Scorer and version | Score | What drives the difference |
|---|---|---|---|
| CVE-2026-85097 (Bricksforge) | Wordfence, CNA, v3.1; Patchstack | 9.8; 10 | Scope; Patchstack shows no vector |
| CVE-2026-87902 (WordPress core) | NVD record, v3.1; WordPress advisory, v4.0 | 8.1 High; 9.2 Critical | AC:H in v3.1, AT:P in v4.0. In KEV since September 25 |
| CVE-2026-39919 (Ghostscript) | VulnCheck, CNA, v3.1 and v4.0; Red Hat, v3.1 | 9.8 and 9.3; 7.8 | Network vs local attack vector |
| CVE-2026-0257 (GlobalProtect) | Palo Alto Networks, CNA, v4.0 CVSS-BT; NIST, v3.1 | 7.8 High; 9.1 Critical | Low vulnerable-system impact in v4.0; C:H and I:H in v3.1 |
The Bricksforge NVD record has no NIST score, and its status was Deferred when we checked.
Drupal advisories use a different scale
Drupal security advisories score risk out of 25 using their own vector, not CVSS. A Drupal "19 of 25, Critical" and a CVSS score of 9.8 are not on the same scale. Our Webform guide explains how to read the Drupal score.
Our guide to Drupal 10 end of life covers what to plan before that date.
Frequently Asked Questions
What is a CVSS score?
A rating from 0.0 to 10.0 of how severe a security flaw could be, maintained by FIRST. It comes with a vector string that records each answer behind the number.
What does a CVSS vector string tell me that the score does not?
How an attacker reaches the flaw and what they can do. AV, PR and UI show whether it works over the internet, without a login, and without a click.
What is the difference between CVSS v3.1 and v4.0 scores?
Version 4.0 adds Attack Requirements, replaces Scope with separate vulnerable and subsequent system impacts, and renames Temporal to Threat. Scores for one flaw often differ.
What do CVSS-B and CVSS-BT mean?
CVSS-B is a base-only score. CVSS-BT adds threat metrics such as Exploit Maturity. CVSS-BE adds environmental metrics, and CVSS-BTE includes all three.
Why do Wordfence, Patchstack and NVD show different scores for one CVE?
Each scorer makes its own calls on metrics like Attack Vector and Scope. Compare the vectors and pick the reading that matches your site.
Is a Medium CVSS score safe to leave for later?
Not always. If it is under attack or easy to reach on your site, it can matter more than a Critical in a plugin you do not use.
Does a high CVSS score mean the flaw is being exploited?
No. A base score says nothing about attacks. Check KEV, Wordfence, Patchstack or the Drupal advisory for exploitation reports.
Are Drupal risk scores the same as CVSS scores?
No. Drupal uses its own 25-point scale. Do not compare a Drupal 19 with a CVSS 9.8 directly.
