Comment by TZubiri

Why is this 8.8?

It's because User Interaction is Required. CVSS 10 would be the case where everyone can be exploited without interaction.

Interestingly the 8.8 is more alert-worthy than the 9.8 and 10 cvss, because there is a need to be alerted of the current security risk, whereas with a cvss 2 vuln, there is nothing to be done by users, only admins.