What is the CVSS score of CVE-2026-2305?

CVE-2026-2305 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2305

EUVD-2026-21288 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-10 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 10, 2026 - 03:45 euvd

EUVD-2026-21288

Analysis Generated

Apr 10, 2026 - 03:45 vuln.today

CVE Published

Apr 10, 2026 - 03:35 nvd

MEDIUM 6.4

DescriptionCVE.org

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aFhfc_head_code, aFhfc_body_code, and aFhfc_footer_code post meta values in all versions up to, and including, 2.3. This is due to the plugin outputting these meta values without any sanitization or escaping. While the plugin restricts its own metabox and save handler to administrators via current_user_can('manage_options'), it does not use register_meta() with an auth_callback to protect these meta keys. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via the WordPress Custom Fields interface that execute when an administrator previews or views the post.

AnalysisAI

Stored cross-site scripting (XSS) in AddFunc Head & Footer Code plugin for WordPress versions up to 2.3 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via custom post meta fields that execute when administrators preview or view posts. The vulnerability exists because the plugin outputs user-supplied code from aFhfc_head_code, aFhfc_body_code, and aFhfc_footer_code meta values without sanitization or escaping, and fails to restrict meta key access via WordPress register_meta() authentication callbacks despite restricting its own admin interface. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The AddFunc Head & Footer Code WordPress plugin is designed to allow code injection into post head, body, and footer sections. The vulnerability stems from improper handling of WordPress post meta (custom fields) which store user-supplied HTML/JavaScript code. The plugin's admin metabox correctly uses current_user_can('manage_options') to restrict writes through its own interface, but this control does not extend to direct post meta manipulation via WordPress's custom fields REST API or database access. The root cause is failure to implement register_meta() with an auth_callback parameter, which would enforce capability checks at the meta key level across all access vectors. The vulnerable code directly echoes meta values (lines 63, 74, 85 in version 2.3) without applying wp_kses_post(), esc_html(), or similar sanitization functions. WordPress custom fields with Contributor-level access become a privilege escalation vector: Contributors can modify post meta through the standard WordPress interface, and their injected scripts execute with administrator-level context during post preview/viewing.

RemediationAI

Update AddFunc Head & Footer Code plugin to version 2.4 or later, which implements proper sanitization and escaping of post meta values, and applies register_meta() with auth callbacks to restrict meta key access. Administrators should immediately update via the WordPress plugin dashboard (Plugins → Updates). For sites unable to immediately update, the temporary workaround is to restrict Contributor-level access: disable post authorship for non-administrators, enforce Editor-level minimum for post creation, or disable the custom fields metabox for non-admin roles via WordPress capability management. Additionally, administrators should audit post meta for existing injected scripts by reviewing aFhfc_head_code, aFhfc_body_code, and aFhfc_footer_code values in the postmeta table. Wordfence provides detailed vulnerability intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/2f2d1a67-1d9b-4b73-988e-085eaa7474c6.