What is the CVSS score of CVE-2026-0738?

CVE-2026-0738 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-0738

EUVD-2026-18977 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

GHSA-xrr8-pmp3-3j6q

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 07:45 euvd

EUVD-2026-18977

Analysis Generated

Apr 04, 2026 - 07:45 vuln.today

CVE Published

Apr 04, 2026 - 07:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Shortcodes Plugin - Shortcodes Ultimate up to version 7.4.8 allows authenticated attackers with author-level permissions to inject arbitrary JavaScript into pages via the su_carousel shortcode's 'su_slide_link' attachment meta field. The vulnerability stems from insufficient input sanitization and output escaping, enabling malicious scripts to execute when any user visits an affected page. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the su_carousel shortcode handler within the Shortcodes Ultimate WordPress plugin (CPE: cpe:2.3:a:gn_themes:wp_shortcodes_plugin_-_shortcodes_ultimate:*:*:*:*:*:*:*:*). The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, or Cross-site Scripting). The 'su_slide_link' parameter, which stores attachment metadata associated with carousel slides, is processed without adequate sanitization before storage and without proper HTML entity encoding before output. This allows an authenticated user to craft a shortcode with JavaScript payload in the su_slide_link field, which is then persistently stored in the WordPress database and executed in the browsers of subsequent visitors. The attack requires author-level or higher privileges, suggesting the attacker must have legitimate WordPress editorial access or the ability to compromise an author account.

RemediationAI

Update the WP Shortcodes Plugin - Shortcodes Ultimate to version 7.4.9 or later, which contains fixes to the carousel.php shortcode handler addressing input sanitization and output escaping of the su_slide_link field. Site administrators should access the WordPress Plugins dashboard, locate 'Shortcodes Ultimate', and apply the available update immediately. Until patching is possible, limit author-level access to trusted users only and regularly audit carousel shortcodes in published posts and pages for suspicious 'su_slide_link' values. Further details on the vulnerability and patch status are available from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/5bfc718a-408b-4389-b03b-bfe152ed7b28?source=cve) and CleanTalk research (https://research.cleantalk.org/cve-2026-0738/).