What is the CVSS score of CVE-2026-1899?

CVE-2026-1899 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1899?

Organizations using all should be aware of moderate risk from CVE-2026-1899, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-1899?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1899

EUVD-2026-13982 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-fhwh-m653-p2c2

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13982

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Any Post Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aps_slider shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on the 'post_type' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Any Post Slider WordPress plugin versions up to 1.0.4 contain a Stored Cross-Site Scripting (XSS) vulnerability in the aps_slider shortcode due to insufficient input sanitization and output escaping on the 'post_type' attribute. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that persists in pages and executes for all users who view the injected content. With a CVSS score of 6.4 and attack complexity marked as low, this represents a moderate-severity threat primarily affecting multi-user WordPress installations where contributor access is delegated.

Technical ContextAI

This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. The Any Post Slider plugin (CPE: cpe:2.3:a:itpathsolutions:any_post_slider:*:*:*:*:*:*:*:*), developed by ITPATHSolutions, processes the 'post_type' shortcode attribute without proper sanitization before storage or escaping before output in the no_content.php partial template. WordPress shortcodes are processed server-side and stored in post_meta or post_content, making stored XSS particularly dangerous as the malicious payload executes every time the page is rendered, affecting all site visitors regardless of their privilege level. The vulnerability exists across the WordPress plugin ecosystem where shortcode handlers fail to use WordPress security functions like sanitize_text_field() during input processing and esc_attr() or esc_html() during output rendering.

RemediationAI

Update the Any Post Slider plugin to version 1.0.5 or later, which should address the input sanitization and output escaping issues in the aps_slider shortcode's post_type attribute handling. Site administrators should access the WordPress plugin dashboard, navigate to Plugins, locate Any Post Slider, and select Update if available; if no update is published, disable or remove the plugin until a security patch is released. As an interim mitigation, restrict Contributor-level access to only trusted users and audit existing pages containing the aps_slider shortcode for suspicious post_type values. Enable WordPress security hardening by activating a Web Application Firewall (such as Wordfence Free or Sucuri) to detect and block XSS payloads. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/562f194f-1f32-4de4-8074-84580f653bdb?source=cve) for confirmation of patch availability and any interim recommendations from the plugin vendor.