What is the CVSS score of CVE-2026-1396?

CVE-2026-1396 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1396

EUVD-2026-20131 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-j8cq-gw56-fpqp

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20131

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:23 nvd

MEDIUM 6.4

DescriptionCVE.org

The Magic Conversation For Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'magic-conversation' shortcode in all versions up to, and including, 3.0.97 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in Magic Conversation For Gravity Forms plugin allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes, executing malicious scripts in pages viewed by any visitor. The vulnerability affects all versions up to and including 3.0.97 and requires no user interaction from the victim. With an EPSS score context of 6.4 CVSS and confirmed patch availability, this represents a moderate-to-significant risk to WordPress sites with untrusted contributor accounts.

Technical ContextAI

The vulnerability stems from insufficient input sanitization and output escaping in the 'magic-conversation' shortcode handler within the Magic Conversation For Gravity Forms plugin (CPE: cpe:2.3:a:magicplugins:magic_conversation_for_gravity_forms:*:*:*:*:*:*:*:*). The shortcode processor fails to properly escape user-supplied shortcode attributes before rendering them in page output, enabling attackers to inject HTML and JavaScript payloads. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation), where malicious input persists in the WordPress database as part of page/post content and executes for all subsequent visitors. The root cause involves the WordPress plugin development anti-pattern of directly interpolating untrusted shortcode attributes into the output without using WordPress escaping functions such as esc_attr() or esc_js().

RemediationAI

Update the Magic Conversation For Gravity Forms plugin to version 3.0.98 or later, which includes proper input sanitization and output escaping. Perform the update through the WordPress admin dashboard (Plugins → Installed Plugins → Magic Conversation For Gravity Forms → Update Now) or via WP-CLI with wp plugin update magic-conversation-for-gravity-forms. As a temporary mitigation pending patch deployment, restrict the 'contributor' WordPress role to trusted team members only and audit existing pages/posts for suspicious shortcode attributes. Remove or edit any 'magic-conversation' shortcodes containing unusual characters, JavaScript keywords, or event handlers. See Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bc425c4a-cb4e-4f50-b85b-8c4c7778c073?source=cve for additional detection signatures and timeline details.