What is the CVSS score of CVE-2026-1851?

CVE-2026-1851 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1851?

Organizations using all should be aware of moderate risk from CVE-2026-1851, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1851?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1851

EUVD-2026-14001 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-p2qc-8gvm-5vgq

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14001

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The iVysilani Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' shortcode attribute in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The iVysilani Shortcode WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'width' shortcode attribute due to insufficient input sanitization and output escaping. All versions up to and including 3.0 are affected, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that persists in page content and executes for all subsequent site visitors. The vulnerability has been documented by Wordfence with proof-of-concept code available in the WordPress plugin repository, presenting a significant risk to WordPress installations relying on this plugin.

Technical ContextAI

The iVysilani Shortcode plugin (CPE: cpe:2.3:a:deckercz:ivysilani_shortcode:*:*:*:*:*:*:*:*) is a WordPress plugin that provides shortcode functionality for embedding content. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The root cause stems from inadequate input validation and output encoding of the 'width' shortcode parameter when it is rendered into page HTML. WordPress shortcodes are processed server-side and their output is embedded directly into page content; when user-supplied input within shortcode attributes is not properly escaped using functions like esc_attr() or esc_html(), attackers can inject malicious script tags or event handlers that will be executed in the context of the webpage, affecting all users who view the compromised page.

RemediationAI

The primary remediation is to upgrade the iVysilani Shortcode plugin to a patched version released after 3.0, which should include proper input sanitization and output escaping of the 'width' shortcode attribute using WordPress escaping functions. Administrators should immediately check for available updates in their WordPress plugin dashboard and apply them. If a patched version is not yet available from the vendor, the plugin should be deactivated and removed until a security update is released, as the stored nature of this XSS vulnerability means malicious payloads could persist in page content indefinitely. Site administrators should also audit recent page and post content created by Contributor-level users to identify and remove any suspicious shortcode attributes, and consider reviewing user access logs for the timeframe in which the plugin was vulnerable. Refer to the Wordfence threat intelligence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/25fc2600-9b57-405e-9956-b55291161700?source=cve for the latest patch status and guidance.