What is the CVSS score of CVE-2026-1891?

CVE-2026-1891 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1891?

Organizations using all should be aware of moderate risk from CVE-2026-1891, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1891?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1891

EUVD-2026-13990 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-v4jm-pj3g-5pv4

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13990

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Simple Football Scoreboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ytmr_fb_scoreboard' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Simple Football Scoreboard plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ytmr_fb_scoreboard' shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 1.0 are affected, allowing authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript that executes for all users viewing the compromised page. With a CVSS score of 6.4 and network-based attack vector requiring only low privileges, this represents a moderate but exploitable threat to WordPress sites using this plugin.

Technical ContextAI

The vulnerability exists in the Simple Football Scoreboard plugin (vendor: Dogrow, identified via CPE cpe:2.3:a:dogrow:simple_football_scoreboard:*:*:*:*:*:*:*:*) and stems from CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Specifically, the shortcode handler at line 310 of ytmr_simple_football_scoreboard.php processes shortcode attributes directly without proper sanitization via functions like sanitize_text_field() or sanitize_url(), and fails to escape output using WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses_post(). This allows malicious shortcode attributes to be rendered as executable JavaScript in the page DOM. The vulnerability is classified as Stored XSS because the malicious payload persists in the post or page content itself rather than being reflected in a URL parameter.

RemediationAI

The primary remediation is to disable and remove the Simple Football Scoreboard plugin immediately, as no patched version has been released by the vendor (Dogrow) and the plugin appears to be unmaintained as of version 1.0. For organizations requiring scoreboard functionality, migrate to actively maintained alternative plugins with proper security practices. As an interim measure if removal is not immediately feasible, restrict Contributor-level and above user roles to trusted administrators only, enforce strict capability checks, and monitor post/page content for suspicious shortcode modifications. Consider using WordPress security plugins such as Wordfence or Sucuri to detect and log shortcode attribute changes. Reference the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/48c114d7-3d53-4157-a335-19cf4b47eed5?source=cve for detailed guidance and continued threat monitoring.