What is the CVSS score of CVE-2026-1854?

CVE-2026-1854 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1854?

Organizations using all should be aware of moderate risk from CVE-2026-1854, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1854?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1854

EUVD-2026-14005 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-qgp7-6qw9-gvc2

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14005

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Post Flagger WordPress plugin for all versions up to and including 1.1, caused by insufficient input sanitization and output escaping in the 'flag' shortcode's user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript code into pages, which executes for all users who view those pages. This vulnerability has a CVSS score of 6.4 (Medium) and is confirmed in the WordPress plugin repository; no evidence of active exploitation or public proof-of-concept is currently documented, but the straightforward nature of the vulnerability suggests exploitation potential.

Technical ContextAI

The Post Flagger plugin (CPE: cpe:2.3:a:nosoycesaros:post_flagger:*:*:*:*:*:*:*:*) is a WordPress extension that provides a shortcode mechanism for flagging content. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting). The root cause lies in the plugin's 'flag' shortcode handler, specifically around line 66 of post-flagger.php (as referenced in the WordPress plugin repository), where shortcode attributes are processed without proper sanitization via WordPress escaping functions such as wp_kses_post() or esc_attr(). When shortcode attributes are rendered into page output, unsanitized user input passes directly into the HTML context, allowing attackers to inject script tags or event handlers that bypass WordPress's default security filters.

RemediationAI

Update the Post Flagger plugin to a patched version immediately; check https://wordpress.org/plugins/post-flagger/ and https://plugins.trac.wordpress.org/browser/post-flagger/ for the latest available version (expected to be version 1.2 or higher). If an update is not yet available, consider deactivating and removing the plugin until a patch is released. For WordPress administrators unable to patch immediately, enforce contributor-level content review by restricting the 'flag' shortcode to administrator-only usage via code filters, or implement a Web Application Firewall (WAF) rule to block script tags in post content. Additionally, audit existing posts created by contributor-level users for malicious shortcode attributes and remove any suspicious entries.