What is the CVSS score of CVE-2026-1607?

CVE-2026-1607 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-1607

EUVD-2026-22205 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 Wordfence

GHSA-99qg-rjrm-54j5

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 04:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 04:00 euvd

EUVD-2026-22205

Analysis Generated

Apr 14, 2026 - 04:00 vuln.today

CVE Published

Apr 14, 2026 - 03:37 nvd

MEDIUM 6.4

DescriptionCVE.org

The Surbma | Booking.com Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's surbma-bookingcom shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Surbma | Booking.com Shortcode WordPress plugin (all versions up to 2.1) allows authenticated contributors and above to inject malicious scripts into pages via insufficient input sanitization on the surbma-bookingcom shortcode attributes, causing arbitrary JavaScript execution for all site visitors accessing the compromised page. The vulnerability has a CVSS score of 6.4 with network-based attack vector and low complexity, requiring only contributor-level privileges to exploit. No public exploit code or active exploitation has been independently confirmed at the time of analysis.

Technical ContextAI

The vulnerability exists in a WordPress shortcode plugin that integrates Booking.com functionality. The root cause is CWE-79 (Cross-site Scripting), specifically a failure to properly sanitize user-supplied input when processing shortcode attributes and escape output when rendering them in page content. The shortcode handler accepts attributes from authenticated users but does not adequately validate or escape these values before insertion into the page DOM, allowing attackers with contributor-level WordPress permissions to embed JavaScript payloads that execute in the browser context of any site visitor. The affected product is tracked via CPE cpe:2.3:a:surbma:surbma_|_booking.com_shortcode:*:*:*:*:*:*:*:*, indicating all versions of the Surbma Booking.com Shortcode plugin are in scope.

RemediationAI

Update the Surbma | Booking.com Shortcode plugin to a version later than 2.1 if a patched release is available; consult the plugin's WordPress directory page or the vendor's official website for the latest version. As an interim mitigation, restrict contributor-level access to trusted users only and audit existing pages created with the surbma-bookingcom shortcode for suspicious content. If no patched version is available, consider disabling the plugin or replacing it with an alternative Booking.com integration solution. Refer to the Wordfence vulnerability report (https://www.wordfence.com/threat-intel/vulnerabilities/id/01280afb-4745-4f36-823e-ed794bb3353a?source=cve) for additional context and potential plugin repository discussions.