What is the CVSS score of CVE-2026-1575?

CVE-2026-1575 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1575?

Organizations using all should be aware of moderate risk from CVE-2026-1575, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1575?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1575

EUVD-2026-14169 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-c6fv-mp3f-p6j3

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14169

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's itemscope shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Schema Shortcode plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the itemscope shortcode that allows authenticated attackers with contributor-level access or higher to inject arbitrary malicious scripts into pages. These injected scripts execute whenever any user accesses the affected page, potentially compromising visitor sessions and data. With a CVSS score of 6.4 and confirmed vulnerability through Wordfence intelligence, this represents a meaningful risk to WordPress sites using this plugin, though exploitation requires authenticated access rather than unauthenticated exploitation.

Technical ContextAI

The vulnerability exists in the Schema Shortcode plugin (identified via CPE cpe:2.3:a:jeric_izon:schema_shortcode:*:*:*:*:*:*:*:*) and stems from insufficient input sanitization and output escaping of user-supplied attributes within the itemscope shortcode handler, as evidenced by code inspection at the plugin's repository line 41. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting). The root cause is that WordPress shortcode attributes are processed without proper sanitization before being rendered in the HTML output, allowing attackers to bypass WordPress's security filters and inject executable JavaScript that runs in the context of authenticated user sessions.

RemediationAI

The primary remediation is to deactivate and remove the Schema Shortcode plugin immediately, as no patched version has been identified in available intelligence. Site administrators should check for any pages or posts using the vulnerable itemscope shortcode and migrate to an alternative schema markup solution (such as Yoast SEO, RankMath, or direct JSON-LD implementation). Until the plugin can be removed, restrict contributor-level and higher permissions to only trusted administrators and regularly audit user roles and permissions. Additionally, implement a Web Application Firewall (WAF) rule to detect and block injection attempts targeting shortcode attributes, and review page/post revision history to identify any injected malicious scripts already present. For ongoing protection, monitor the WordPress plugin repository and Wordfence advisories (https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c89d80-0ae5-4849-b739-0881fec188bf) for patch availability or official plugin discontinuation notices.