What is the CVSS score of CVE-2026-1093?

CVE-2026-1093 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1093?

Organizations using all should be aware of moderate risk from CVE-2026-1093, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1093?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1093

EUVD-2026-13996 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-v6ph-2p6j-56h7

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13996

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WPFAQBlock- FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The WPFAQBlock plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the 'class' parameter of the 'wpfaqblock' shortcode, affecting all versions up to and including 1.1. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in pages and executes for all users visiting those pages. With a CVSS score of 6.4 and low attack complexity, this represents a moderate-to-significant risk for WordPress installations using this plugin, particularly on multi-author sites where contributor accounts may be compromised or malicious.

Technical ContextAI

The vulnerability stems from insufficient input sanitization and output escaping of user-supplied attributes in the 'wpfaqblock' shortcode handler, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected product is the WPFAQBlock – FAQ & Accordion Plugin For Gutenberg (CPE: cpe:2.3:a:creativewerkdesigns:wpfaqblock–_faq_&_accordion_plugin_for_gutenberg), which integrates with WordPress's Gutenberg block editor. The vulnerable code path has been identified in the template-1.php file within the includes/templates directory, where the 'class' parameter is passed directly to HTML output without proper escaping functions such as esc_attr(). This allows an attacker to break out of the HTML attribute context and inject arbitrary script tags or event handlers.

RemediationAI

Immediately deactivate and remove the WPFAQBlock plugin from all affected WordPress installations until a security patch is released by the vendor. For sites that depend on the plugin's functionality, monitor the official WordPress plugin repository and Wordfence Intelligence feed for patch availability at https://www.wordfence.com/threat-intel/vulnerabilities/id/3a3147b5-0362-4299-8339-655eaade948e. As an interim mitigation, restrict Contributor-level and above account access to trusted personnel only, audit recent content changes for injected scripts in pages using the shortcode, and consider implementing a Web Application Firewall (WAF) rule to detect and block malicious class attribute patterns in shortcode parameters. If the plugin remains active pending a patch, limit its use to administrative or read-only pages and monitor site logs for suspicious script execution.