What is the CVSS score of CVE-2026-2437?

CVE-2026-2437 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2437

EUVD-2026-18983 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-04 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 04, 2026 - 08:45 euvd

EUVD-2026-18983

Analysis Generated

Apr 04, 2026 - 08:45 vuln.today

CVE Published

Apr 04, 2026 - 08:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Travel Engine - Tour Booking Plugin - Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Travel Engine plugin versions up to 6.7.5 allows authenticated contributors and above to inject malicious scripts via the 'wte_trip_tax' shortcode due to insufficient input sanitization and output escaping. When site visitors access pages containing the injected payload, the arbitrary JavaScript executes in their browsers, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the WP Travel Engine - Tour Booking Plugin (CPE: cpe:2.3:a:wptravelengine:wp_travel_engine_-_tour_booking_plugin_-_tour_operator_software:*:*:*:*:*:*:*:*), a WordPress plugin for tour booking functionality. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting). The plugin's 'wte_trip_tax' shortcode handler fails to properly sanitize user-supplied attributes before storing them in the database and fails to escape output when the shortcode is rendered. This allows attackers to embed JavaScript payloads within shortcode parameters that persist in the database and execute whenever any user views the affected page, creating a stored XSS condition rather than a transient one.

RemediationAI

Vendor-released patch: WP Travel Engine 6.7.6 addresses this vulnerability by implementing proper input sanitization and output escaping for the 'wte_trip_tax' shortcode. Site administrators should upgrade immediately to version 6.7.6 or later via the WordPress plugin update interface or by downloading directly from the plugin repository. The patch is confirmed in the official repository changeset at https://plugins.trac.wordpress.org/changeset/3467196/wp-travel-engine/tags/6.7.6/includes/class-wp-travel-engine-custom-shortcodes.php. As a temporary workaround pending upgrade, restrict contributor-level access to only trusted users and audit existing pages using the 'wte_trip_tax' shortcode for suspicious attribute values. No other workarounds mitigate the stored payload risk.