What is the CVSS score of CVE-2026-2505?

CVE-2026-2505 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2505

EUVD-2026-23672 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-18 Wordfence

XSS WordPress

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 09:50 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 09:30 euvd

EUVD-2026-23672

Analysis Generated

Apr 18, 2026 - 09:30 vuln.today

CVE Published

Apr 18, 2026 - 09:26 nvd

MEDIUM 5.4

DescriptionCVE.org

The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute when users interact with the injected frontend page via the 'class' shortcode attribute.

AnalysisAI

Stored Cross-Site Scripting in Categories Images WordPress plugin versions up to 3.3.1 allows authenticated contributors and above to inject malicious scripts via the 'class' attribute of the 'z_taxonomy_image' shortcode, which executes in the context of other users viewing the affected page. The vulnerability stems from insufficient HTML escaping in the shortcode's fallback image builder. No public exploit code or active exploitation has been identified, but the attack requires only authenticated contributor-level access and user interaction with the injected content.

Technical ContextAI

The Categories Images plugin for WordPress provides a shortcode-based mechanism to display taxonomy-associated images on the frontend. The 'z_taxonomy_image' shortcode accepts a 'class' parameter that is passed directly into HTML attribute concatenation within a fallback image builder without proper sanitization or escaping. This is a classic stored XSS vector in WordPress plugin development, where user-supplied shortcode attributes flow into the DOM without filtering. The CWE-79 classification (Improper Neutralization of Input During Web Page Generation) confirms that the root cause is failure to escape output when rendering untrusted input as HTML attributes. The affected product is identified by CPE cpe:2.3:a:elzahlan:categories_images:*:*:*:*:*:*:*:*, indicating all versions of the plugin from vendor 'elzahlan' up to and including 3.3.1.

RemediationAI

Update the Categories Images plugin to version 3.3.2 or later, which addresses the HTML escaping vulnerability. Site administrators should navigate to Plugins → Installed Plugins in the WordPress dashboard, locate 'Categories Images', and click 'Update Now' to apply the patch. If immediate updating is not possible, a compensating control is to restrict the 'Contributor' role's ability to use custom shortcodes by implementing role-based capability restrictions via a security plugin (such as Members or Advanced Access Manager) or custom code that removes the shortcode usage capability from Contributor roles, limiting shortcode editing to Editors and Administrators only. This control trades plugin functionality for reduced attack surface in multi-user environments. Alternatively, temporarily deactivate the Categories Images plugin until the patch is applied. For sites unable to update, regularly audit published content for suspicious shortcode attributes and monitor user activity logs for contributor-level account abuse.