What is the CVSS score of CVE-2026-1278?

CVE-2026-1278 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1278?

Organizations using Mandatory Field should be aware of moderate risk from CVE-2026-1278, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate CVE-2026-1278?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Stored Cross-Site Scripting v and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1278

EUVD-2026-14155 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-58r6-ffpc-qpg6

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14155

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Mandatory Field plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

The Mandatory Field plugin for WordPress versions up to 1.6.8 contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings due to insufficient input sanitization and output escaping. Authenticated administrators can inject arbitrary JavaScript that executes for all users accessing affected pages, but exploitation is limited to multi-site WordPress installations or those with unfiltered_html disabled. With a CVSS score of 4.4 and high attack complexity, this represents a moderate-severity privilege escalation risk for WordPress administrators seeking to inject malicious scripts; no public POC or active exploitation has been indicated in KEV data.

Technical ContextAI

This vulnerability is a Stored XSS flaw (CWE-79) in the Mandatory Field WordPress plugin (CPE: cpe:2.3:a:ketanmujumdar:mandatory_field:*:*:*:*:*:*:*:*), affecting all versions through 1.6.8. The root cause lies in the admin settings handler (identified in mandatory-plugin-option-page.php at line 14) which fails to properly sanitize user input before storing it in the database and fails to escape output when rendering saved settings. WordPress's sanitize_text_field() or wp_kses_post() functions should have been applied to $_POST data, and esc_attr() or esc_html() should have been applied during output. The vulnerability is scoped to multi-site WordPress installations or single-site installations where the unfiltered_html capability has been explicitly disabled, narrowing the attack surface compared to standard WordPress configurations where administrators typically retain unfiltered HTML privileges.

RemediationAI

Upgrade the Mandatory Field plugin to a version newer than 1.6.8 if a patched version has been released; check the WordPress plugin repository at https://wordpress.org/plugins/mandatory-fields/ for the latest version and update through the WordPress admin dashboard. Until a patch is available, restrict administrator account access to trusted personnel only, audit recent admin settings changes for injected script content, and monitor page source output for unexpected script tags in plugin-controlled settings fields. For multi-site installations, consider enforcing Content Security Policy (CSP) headers via HTTP headers to prevent inline script execution as a defense-in-depth measure. If the plugin is no longer maintained, consider switching to an actively maintained alternative for mandatory field functionality.