What is the CVSS score of CVE-2026-1263?

CVE-2026-1263 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1263

EUVD-2026-21248 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 01:45 euvd

EUVD-2026-21248

Analysis Generated

Apr 10, 2026 - 01:45 vuln.today

CVE Published

Apr 10, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The Webling plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.0 due to insufficient input sanitization, insufficient output escaping, and missing capabilities checks in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject Webling forms and memberlists with arbitrary web scripts that will execute whenever an administrator views the related form or memberlist area of the WordPress admin.

AnalysisAI

Stored Cross-Site Scripting (XSS) in the Webling WordPress plugin versions up to 3.9.0 allows authenticated attackers with Subscriber-level access to inject malicious scripts into forms and memberlists that execute when administrators view the admin interface. The vulnerability stems from insufficient input sanitization and output escaping in the 'webling_admin_save_form' and 'webling_admin_save_memberlist' functions, combined with missing capability checks. No public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

The Webling plugin for WordPress (CPE: cpe:2.3:a:usystemsgmbh:webling:*:*:*:*:*:*:*:*) contains a Stored Cross-Site Scripting vulnerability classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause involves three security gaps in the admin form and memberlist handling functions: first, insufficient sanitization of user-supplied input when forms and memberlists are saved; second, inadequate HTML entity encoding when these inputs are displayed back in the WordPress admin dashboard; and third, missing permission checks that should restrict these functions to high-privilege roles only. Because the vulnerable code paths accept data from Subscriber-level users but fail to properly sanitize or escape before storage and display, any authenticated user at the lowest permission tier can plant persistent malicious JavaScript that activates whenever an administrator accesses the affected admin pages, potentially leading to credential theft, admin account compromise, or further WordPress installation compromise.

RemediationAI

Vendor-released patch: Webling 3.9.1. WordPress administrators should immediately update the Webling plugin to version 3.9.1 or later via the WordPress admin dashboard (Plugins > Installed Plugins > Webling > Update Now) or manually via plugins.wordpress.org. Organizations unable to update immediately should restrict Webling form and memberlist admin pages to high-privilege users only via WordPress user role management, though this does not eliminate the risk to existing Subscriber accounts. Verify that all user accounts with Subscriber or higher roles are legitimate and review the WordPress audit log (if available via security plugins) for suspicious form or memberlist modifications. The vulnerability details and patch are documented in the Wordfence threat intelligence report linked in the advisory.