What is the CVSS score of CVE-2026-2358?

CVE-2026-2358 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2358?

Organizations using all should be aware of moderate risk from CVE-2026-2358, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-2358?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2358

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-11 security@wordfence.com

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 06:17 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [wp_ulike_likers_box] shortcode template attribute in all versions up to, and including, 5.0.1. This is due to the use of html_entity_decode() on shortcode attributes without subsequent output sanitization, which effectively bypasses WordPress's wp_kses_post() content filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The post must have at least one like for the XSS to render.

AnalysisAI

Stored XSS in the WP ULike WordPress plugin up to version 5.0.1 allows authenticated users with Contributor access or higher to inject malicious scripts into pages through the shortcode template attribute, which executes when visitors view affected content. The vulnerability stems from improper use of html_entity_decode() that circumvents WordPress sanitization filters, requiring at least one like on a post to trigger payload execution. No patch is currently available.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects WP ULike (WordPress plugin). The WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [wp_ulike_likers_box] shortcode template attribute in all versions up to, and including, 5.0.1. This is due to the use of html_entity_decode() on shortcode attributes without subsequent output sanitization, which effectively bypasses WordPress's wp_kses_post() content filtering. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts

Affected ProductsAI

Vendor: WordPress. Product: WP ULike (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.