What is CVSS?
CVSS is the scoring system that tells you how severe a security vulnerability is, on a scale from zero to ten. It stands for the Common Vulnerability Scoring System, and it exists to answer the question every site owner asks when a flaw is found: how worried should I be? A CVSS score turns a technical vulnerability into a single number and a severity label, so you can compare issues fairly and decide what to fix first.
What is CVSS and why does it matter?
When a scan finds several problems, you need a consistent way to rank them. CVSS provides exactly that. Because the same formula is applied to every vulnerability, a score of nine means roughly the same level of danger whether the flaw is in a WordPress plugin or a database server. This shared scale lets you triage sensibly, spending your limited time on the issues most likely to get you breached rather than chasing whatever looks alarming at first glance.
How the CVSS score is calculated
A CVSS score is built from a set of metrics that describe how a vulnerability behaves. The base metrics, which produce the score you usually see, consider several factors:
- Attack vector, whether the flaw can be exploited over the network or only with local access.
- Attack complexity, how hard the exploit is to pull off.
- Privileges required and whether any user interaction is needed.
- Impact on the confidentiality, integrity and availability of the affected system.
These combine into the final number. There are also optional temporal and environmental metrics that adjust the score for real-world exploit availability and for your specific setup.
CVSS severity ratings
The numeric score maps onto plain-language bands: none, low for scores up to about four, medium up to seven, high up to nine, and critical for the very top. Critical vulnerabilities typically allow a remote attacker to take over a system with little effort, which is why they demand immediate attention. A medium issue still matters but rarely justifies an emergency.
CVSS versions
The scoring system has evolved. Version 3.1 is still widely used, and version 4.0 refines how impact and exploitability are measured to give more nuanced scores. You may see either in reports. The band names stay the same, so a high or critical rating means the same urgent thing regardless of the version behind it.
The limits of a CVSS score
A base CVSS score describes a vulnerability in the abstract, not your particular situation. A critical flaw in a component you do not expose to the internet may be less urgent for you than a high one that faces the public web. Crucially, CVSS does not by itself tell you whether attackers are actually exploiting a flaw right now. That is why it pairs well with the actively-exploited catalogue described in what a CISA KEV vulnerability is. Together, the score and the exploitation status give a fuller picture than either alone. Each score is attached to a CVE, the identifier for the underlying flaw.
How to use CVSS on your site
The practical value of CVSS is prioritisation. Run a security scan with EzyAudit AI and every vulnerability we find comes with its CVSS severity, so your report is automatically ordered from most to least dangerous. Instead of a flat list, you get a clear plan of what to fix first. See the full range of checks we run. For the official methodology and a score calculator, visit the standard maintained by FIRST, the organisation behind CVSS.
A CVSS score is the difference between a confusing list of problems and a ranked plan of action. Scan your website now to see your vulnerabilities scored and prioritised.