What is the CVSS score of CVE-2026-2501?

CVE-2026-2501 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2501?

Organizations using all should be aware of moderate risk from CVE-2026-2501, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-2501?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-2501

EUVD-2026-14148 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-54jx-h2q6-qwrf

GHSA-6f9v-56p4-5qf4

GHSA-9286-3frp-2c9j

GHSA-ffxr-cwx4-68hm

GHSA-g35p-qgfm-w6v2

GHSA-qmh9-pqqv-cwmx

GHSA-v62j-2996-2vg6

GHSA-wx22-gmgf-5j2h

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14148

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ed's Social Share plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social_share shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Ed's Social Share plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the social_share shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 2.0 are affected, allowing authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript that executes for all users viewing the compromised page. With a CVSS score of 6.4 and network-accessible attack vector requiring only low privileges, this vulnerability poses a moderate-to-significant risk in multi-author WordPress environments.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), a critical input validation flaw in the WordPress plugin ecosystem. The affected product, Ed's Social Share (CPE: cpe:2.3:a:waianaeboy702:ed's_social_share:*:*:*:*:*:*:*:*), implements a shortcode handler at line 180 of eds_social_share.php that processes shortcode attributes without proper sanitization before rendering them in page content. WordPress shortcodes are executed server-side during page rendering, making stored XSS payloads persistent in the WordPress database and executable whenever the page is accessed. The root cause is the absence of WordPress security functions like sanitize_text_field() during input processing and esc_html(), esc_attr(), or wp_kses_post() during output rendering.

RemediationAI

Immediately disable and remove Ed's Social Share plugin version 2.0 and all earlier versions from affected WordPress installations. If the plugin's functionality is critical, replace it with a maintained alternative from the WordPress plugin repository that implements proper input sanitization and output escaping, such as verified plugins with active security records. If temporary continued use is required, apply manual code patching to line 180 of eds_social_share.php by adding WordPress sanitization functions (sanitize_text_field()) to all shortcode attribute inputs and proper escaping functions (esc_html() or esc_attr()) to all output rendering. Additionally, restrict contributor-level access to only trusted users, implement Web Application Firewall (WAF) rules to detect XSS patterns in shortcode content, and enable WordPress security plugins that provide stored XSS detection and prevention. Further information and exploitation details are available from Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/e4ac5f28-8727-4205-abe5-7f29a0c4dc5d?source=cve.