What is the CVSS score of CVE-2026-0737?

CVE-2026-0737 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-0737

EUVD-2026-18975 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

GHSA-5cm4-3q8m-3rc4

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 07:45 euvd

EUVD-2026-18975

Analysis Generated

Apr 04, 2026 - 07:45 vuln.today

CVE Published

Apr 04, 2026 - 07:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.7 allows authenticated contributors and above to inject arbitrary JavaScript via the 'src' attribute of the su_lightbox shortcode, which executes in the browsers of all users viewing the affected page. The vulnerability stems from insufficient input sanitization and output escaping, requiring only contributor-level access to exploit. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability exists in the su_lightbox shortcode implementation within the Shortcodes Ultimate WordPress plugin (CPE: cpe:2.3:a:gn_themes:wp_shortcodes_plugin_-_shortcodes_ultimate:*:*:*:*:*:*:*:*). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classical Stored XSS flaw. The 'src' attribute parameter is processed without adequate input validation or HTML entity encoding before being rendered in page output. This allows malicious actors with contributor-level WordPress permissions to craft shortcode content containing JavaScript payloads that persist in the database and execute client-side whenever any user loads the page.

RemediationAI

Update the WP Shortcodes Plugin - Shortcodes Ultimate to version 7.4.8 or later immediately. Site administrators should first verify the current installed version within the WordPress plugin dashboard, then apply the update through the standard WordPress plugin management interface. If automatic updates are disabled, manual download and installation from plugins.wordpress.org/shortcodes-ultimate is required. As an interim mitigation before patching, restrict contributor-level access to trusted users only and audit existing pages for suspicious su_lightbox shortcode usage. Post-remediation, review user-generated content for injected scripts. Full advisory details are available from Wordfence threat intelligence and CleanTalk research.