What is the CVSS score of CVE-2026-1889?

CVE-2026-1889 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Outgrow are affected by CVE-2026-1889?

Organizations using all should be aware of moderate risk from CVE-2026-1889, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1889?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Outgrow CVE-2026-1889

EUVD-2026-14002 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-fmp5-jw72-jvq9

WordPress XSS Outgrow Wordpress Plugin

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14002

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Outgrow WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 2.1, affecting the 'id' attribute of the 'outgrow' shortcode due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary JavaScript that executes for all users viewing affected pages. With a CVSS score of 6.4 and moderate attack complexity, this vulnerability poses a real threat to WordPress sites using this plugin, as privilege escalation through stored XSS could enable further compromise.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-supplied shortcode attributes are not properly sanitized before being rendered in the page output. The Outgrow plugin (cpe:2.3:a:outgrow:outgrow:*:*:*:*:*:*:*:*) uses WordPress shortcodes to embed interactive content, and specifically the 'id' attribute lacks both input validation and output escaping mechanisms. Code analysis via the WordPress plugin repository (plugins.trac.wordpress.org/browser/outgrow/trunk/newOutgrow.php#L87) shows that shortcode attributes are directly processed without sanitization functions like sanitize_text_field() or escaping functions like esc_attr(), allowing malicious payloads to pass through to the rendered HTML.

RemediationAI

Update the Outgrow plugin to version 2.2 or later, which should include fixes for input sanitization and output escaping on the shortcode 'id' attribute. Users should verify the patch via the official WordPress plugin repository at https://wordpress.org/plugins/outgrow/. As an interim mitigation pending plugin updates, site administrators should restrict contributor-level access to only trusted users, disable the Outgrow plugin if unused, or implement a Web Application Firewall rule to detect and block shortcode injection patterns. Additionally, review existing pages and posts for suspicious shortcode usage or script injection in the 'id' attribute and remediate any compromised content.