What is the CVSS score of CVE-2026-10024?

CVE-2026-10024 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

TinyMCE Shortcode Addon CVE-2026-10024

EUVD-2026-35303 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-rm47-9ww2-6qqm

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:31 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The TinyMCE shortcode Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the TinyMCE Shortcode Addon WordPress plugin (all versions ≤ 1.0.0) allows authenticated attackers with contributor-level access or higher to inject persistent JavaScript via the unsanitized 'btnrel' shortcode attribute. The injected script is stored server-side and executes in the browser of every subsequent visitor to the affected page, including administrators - enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes the root cause: user-supplied input is accepted, stored, and later rendered into HTML without adequate sanitization or output escaping. The affected plugin, CPE cpe:2.3:a:360crest:tinymce_shortcode_addon:*:*:*:*:*:*:*:*, extends WordPress's TinyMCE editor with custom shortcodes that transform bracket-syntax macros (e.g., [button btnrel='value']) into rendered HTML. Per the plugin source code at shortcode-functions.php lines 50 and 59, the 'btnrel' attribute value is passed through to HTML output without sanitization, allowing attacker-controlled strings to break out of attribute context and inject arbitrary script. The CVSS Scope:Changed (S:C) rating reflects that the injected payload executes in the security context of other users - including higher-privileged ones - crossing a privilege boundary beyond the contributor who injected it.

RemediationAI

No vendor-released patched version has been identified in the available data - patch status is unconfirmed as of this analysis. The primary compensating control is immediate deactivation and removal of the TinyMCE Shortcode Addon plugin (slug: 360crest-themeone-tinymce-shortcodes) until 360crest releases a remediated version; deactivation eliminates the attack surface entirely but removes the plugin's shortcode functionality. If the plugin cannot be removed, restrict contributor-level and above account creation to fully trusted individuals and audit existing contributor accounts for unauthorized additions, since the vulnerability is exploitable only by authenticated contributors or higher. A Web Application Firewall rule targeting script-containing values in the 'btnrel' shortcode parameter may offer partial mitigation but introduces a risk of false positives and should not substitute for plugin removal. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2828d393-953a-4354-9032-687efda2df33?source=cve and the WordPress plugin repository for a patched release announcement.