What is the CVSS score of CVE-2026-1806?

CVE-2026-1806 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1806?

Organizations using all should be aware of moderate risk from CVE-2026-1806, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1806?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1806

EUVD-2026-13989 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-rrx8-cfx4-2hpp

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13989

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Tour & Activity Operator Plugin for TourCMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the tourcms_doc_link shortcode in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Tour & Activity Operator Plugin for TourCMS (all versions up to 1.7.0) affecting WordPress installations. The vulnerability resides in the 'target' parameter of the tourcms_doc_link shortcode, where insufficient input sanitization and output escaping allows authenticated attackers with Contributor-level privileges and above to inject arbitrary JavaScript code that executes in the browsers of users visiting affected pages. With a CVSS score of 6.4 and network-based attack vector requiring only low privileges, this represents a moderate but exploitable risk to WordPress sites using this plugin.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting or XSS). The Tour & Activity Operator Plugin for TourCMS (CPE: cpe:2.3:a:tourcms:tour_&_activity_operator_plugin_for_tourcms) implements a WordPress shortcode handler (tourcms_doc_link) that processes user-supplied parameters without proper sanitization before rendering them in the page output. The affected code is located in tourcms-plugin.php at line 1530 (confirmed via WordPress plugin repository references). When the shortcode is processed, the 'target' parameter is directly output to the HTML response without escaping HTML entities or applying WordPress security functions like esc_attr() or esc_url(), allowing an attacker to break out of attribute context and inject script tags or event handlers.

RemediationAI

Update the Tour & Activity Operator Plugin for TourCMS to a patched version greater than 1.7.0 immediately. Consult the Wordfence vulnerability intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/4e9f16e1-9748-4f5d-84f0-19da68d4f862?source=cve) for patch availability and official plugin updates. As a temporary mitigation, restrict Contributor-level account creation and regularly audit existing Contributor accounts for suspicious activity; additionally, disable or remove the tourcms_doc_link shortcode from all published content if the plugin cannot be immediately updated. Implement Web Application Firewall (WAF) rules to detect and block shortcode attribute injections containing script tags or JavaScript event handlers. WordPress administrators should also review site access logs and user activity during the vulnerability window to detect potential exploitation.