CVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. HostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. providers, security tools and site owners can all use the same number to compare problems.
What is CVSS?
CVSS stands for Common Vulnerability Scoring System. It turns a technical description into one number, based on how the weakness can be attacked and what its impact is.
CVSS is maintained by FIRST, a nonprofit forum of security teams. The base score is built from a handful of questions about the flaw itself. Can it be attacked over the network or only from the machine itself? How complicated is the attack? Does the attacker need a login or a click from a user? And what happens if it works: can data leak, be changed, or can the service go down?
The result maps to a severity band: low, medium, high or critical. The current version is CVSS 4.0, but you will still see 3.x scores on older records. The version is always part of the score, so write “CVSS v4.0 9.2” and not just “9.2”.
What the score does not tell you
A base score says nothing about your own situation. It does not know whether you run the affected version, whether the vulnerable feature is switched on, or whether attackers are using the flaw. Real-world exploitation is tracked separately, in lists such as CISA KEVCISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks.. Treat CVSS as a way to sort the queue, not as a prediction of what will happen to your site.
What CVSS means for a PHP site
Every CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. record can carry a CVSS score, and scanners and hosting dashboards usually repeat it. The score may come from the party that published the record or from the NVDThe NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness., which adds its own analysis later. Two scores for one flaw are normal, and the difference is worth a look before you panic or relax.
The most severe scores often go to remote code executionRemote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws. flaws, where an attacker can run code on the server over the network. In a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. runtime that is exactly the kind of weakness that touches every site on the server, whichever CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. it uses.
A concrete example
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Group published two CVE records for the fixed flaws, CVE-2026-109618 and CVE-2026-109619, and each carries a CVSS v4.0 score of 9.2. The records describe it as reachable over the network, with high attack complexity and no privileges or user interaction needed. The NVD completed its analysis at 17:01 UTC and gives both its own score of CVSS v3.1 9.8. So two scores for one flaw, both critical.
That one example shows how to read a score: it comes from a named party, it has a version and it comes with a vector that explains the number. For the full, timed list of what we know, see the PHP2Shell page.
When a high score needs action from you
A high or critical score in software you actually run means: find out your version today, and plan the update within days, not months. check your PHP version as your site shows it to the outside, using the free tool. If your PHP branchA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. no longer gets fixes, no update will arrive, and moving to a supported version through our service to update PHP in WordPress is the real answer. A low score on a pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. you do not use needs no rush, but it still belongs on your list for the next maintenance window.
Whatever the number, keep the order calm: version first, fix second, exploitation news third. A score is a starting point for a decision, and the decision is yours.
Frequently asked questions
What is a good or bad CVSS score?
The scale runs from 0 to 10, and higher means more severe. The standard bands are low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0). A score describes the flaw, so a high number is a reason to look closer, not a verdict on your site.
Who decides the CVSS score of a vulnerability?
Usually the party that publishes the CVE record, such as the software project, scores it first. Others, like the NVD, may add their own score later, and the two can differ. Always check who supplied the score you are reading.
Does a CVSS 9.2 mean I have been hacked?
No. The score rates how serious the weakness is in theory, not whether anyone attacked your site. It tells you how urgently to check your version and plan an update.
Is CVSS the only thing I should look at?
No. Combine it with whether you run an affected version, whether the vulnerable part is reachable from the internet and whether there is evidence of real-world exploitation, for example in the CISA KEV catalog.