What is the CVSS score of CVE-2026-1275?

CVE-2026-1275 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1275?

Organizations using all should be aware of moderate risk from CVE-2026-1275, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1275?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1275

EUVD-2026-14171 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-9479-m26h-g85h

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14171

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the post_slides_shortcode function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Multi Post Carousel by Category WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'slides' shortcode attribute due to insufficient input sanitization and output escaping in the post_slides_shortcode function. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code into pages, and the malicious script will execute whenever any user visits the affected page. With a CVSS score of 6.4 and confirmed vulnerability across all versions up to and including 1.4, this represents a moderate-risk vulnerability primarily affecting WordPress sites using this plugin.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where user-supplied input is not properly sanitized before being rendered in HTML context. The affected product, identified via CPE as cpe:2.3:a:gbsdeveloper:multi_post_carousel_by_category:*:*:*:*:*:*:*:*, is a WordPress plugin that processes shortcode attributes. The vulnerable code path exists in the post_slides_shortcode function at line 174 of the plugin's main file, where the 'slides' parameter is accepted directly from shortcode markup without applying WordPress sanitization functions (such as sanitize_text_field or wp_kses_post) or proper output escaping (such as esc_attr or wp_json_encode). This allows attackers to bypass the plugin's processing and inject script tags or event handlers that execute in the browser context of users viewing the page.

RemediationAI

The primary remediation is to update the Multi Post Carousel by Category plugin to a version after 1.4 that includes patched sanitization and output escaping. WordPress administrators should immediately upgrade the plugin through the WordPress admin dashboard (Plugins > Installed Plugins > Multi Post Carousel by Category > Update) or download the latest version from https://plugins.trac.wordpress.org/browser/multi-post-carousel/trunk/multi-post-carousel.php#L174. Until patching is possible, administrators should restrict Contributor-level access to only trusted users and audit existing posts and pages using the '[post_slides]' shortcode for any suspicious injected content, removing any pages with untrusted shortcode attributes. Additionally, implementing a Web Application Firewall (WAF) rule to detect and block script injection patterns in shortcode attributes can provide temporary mitigation.