What is the CVSS score of CVE-2026-1986?

CVE-2026-1986 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1986?

Organizations using all should be aware of moderate risk from CVE-2026-1986, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-1986?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-1986

EUVD-2026-16084 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 Wordfence

GHSA-g85c-6q3h-m8pv

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 03:45 euvd

EUVD-2026-16084

Analysis Generated

Mar 26, 2026 - 03:45 vuln.today

CVE Published

Mar 26, 2026 - 02:25 nvd

MEDIUM 6.1

DescriptionCVE.org

The FloristPress for Woo - Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

A Reflected Cross-Site Scripting (XSS) vulnerability exists in FloristPress for Woo (BakkBone) plugin versions up to 7.8.2, where the 'noresults' parameter is insufficiently sanitized and escaped, allowing unauthenticated attackers to inject arbitrary JavaScript. An attacker can craft a malicious URL and trick users into clicking it, resulting in script execution within the victim's browser session with access to sensitive data and session tokens. The vulnerability requires user interaction (UI:R) but has a network attack vector with low complexity, and while no KEV or confirmed active exploitation data is available in the provided intelligence, Wordfence has documented the issue with references to vulnerable code locations.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting), a foundational web application security flaw. The affected product is FloristPress for Woo (CPE:2.3:a:bakkbone:floristpress_for_woo_-_customize_your_ecommerce_store_for_your_florist), a WordPress plugin that customizes eCommerce stores for florists. The specific vulnerability resides in the AJAX handler at src/core/ajax.php (line 1583 as referenced in the WordPress plugin repository), where user-supplied input from the 'noresults' parameter is reflected back into the HTTP response without proper sanitization using WordPress security functions like sanitize_text_field() or escaping output using esc_attr() or esc_html(). This failure allows an attacker-controlled payload to be interpreted as executable code by the browser DOM or JavaScript engines.

RemediationAI

Upgrade FloristPress for Woo to a patched version beyond 7.8.2 immediately; check the vendor's WordPress plugin page or BakkBone's official website for the latest available version, with reference to the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea3b6fa6-1b58-40c2-8ec2-8a9211069f11?source=cve for patch details and version numbers. The underlying fix requires implementing proper input validation and output encoding for the 'noresults' parameter using WordPress sanitization functions (such as sanitize_text_field()) on input and escaping functions (such as esc_attr() or wp_kses_post()) on output. Until the plugin is patched, implement a Web Application Firewall (WAF) rule to block requests with suspicious script-like payloads in the 'noresults' parameter, and educate staff and customers to avoid clicking untrusted links to your website; additionally, monitor for signs of XSS exploitation (unusual JavaScript execution, session anomalies) in web server and WordPress security logs.