What is the CVSS score of CVE-2026-2434?

CVE-2026-2434 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2434

EUVD-2026-23567 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 Wordfence

GHSA-hjc3-w98v-9hcr

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 23:09 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 22:45 euvd

EUVD-2026-23567

Analysis Generated

Apr 17, 2026 - 22:45 vuln.today

CVE Published

Apr 17, 2026 - 22:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Pz-LinkCard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blogcard' shortcode attributes in all versions up to, and including, 2.5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored XSS in Pz-LinkCard WordPress plugin (all versions through 2.5.8.1) allows Contributor-level authenticated users to inject malicious scripts via the 'blogcard' shortcode attributes due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Pz-LinkCard plugin processes the 'blogcard' shortcode and passes user-supplied attributes to output functions without proper sanitization (WordPress esc_attr() or wp_kses_post()) or escaping. The vulnerability exists in the shortcode handler (referenced at lines 442 and 636 of the plugin file), which likely constructs HTML output from unvalidated shortcode parameters. This is a classic CWE-79 Improper Neutralization of Input During Web Page Generation (Stored XSS), where user input flows directly into page rendering without context-appropriate encoding. The CPE cpe:2.3:a:poporon:pz-linkcard:*:*:*:*:*:*:*:* covers all versions of the plugin, with the vulnerability confirmed through version 2.5.8.1.

RemediationAI

Update Pz-LinkCard plugin to version 2.5.9 or later once released by the vendor (Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/687ffac2-1f07-4adb-ba12-5f2ea357ea7e?source=cve should contain patch version confirmation). No patch version is specified in provided data; contact vendor or monitor WordPress plugin repository for security update. Until patched, disable the Pz-LinkCard plugin entirely if possible, or restrict Contributor-level role to trusted internal staff only using user management plugins like User Role Editor. For high-risk sites, implement a Content Security Policy (CSP) header with script-src 'self' to mitigate stored XSS impact - this prevents injected scripts from executing external payloads but does not block same-origin script execution, so inline payload risk remains. Monitor contributor-published pages for suspicious shortcode attributes using audit logging. Server-side input validation via Web Application Firewall (e.g., ModSecurity) can reject shortcode parameters containing <, >, or quote characters, with the trade-off of potentially breaking legitimate content if contributors use special characters.