What is the CVSS score of CVE-2026-2602?

CVE-2026-2602 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-2602?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Twentig Supercharged Block Editor Blocks Patterns Starter Sites Portfolio CVE-2026-2602

Q: Which versions of Twentig Supercharged Block Editor Blocks Patterns Starter Sites Portfolio are affected by CVE-2026-2602?

Organizations using versions should be aware of moderate risk from CVE-2026-2602, a cross-site scripting vulnerability rated CVSS 6.4.

EUVD-2026-16965 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-29 Wordfence

GHSA-p2h8-5v2r-2vg8

WordPress XSS Twentig Supercharged Block Editor Blocks Patterns Starter Sites Portfolio Wordpress Plugin

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 29, 2026 - 02:15 euvd

EUVD-2026-16965

Analysis Generated

Mar 29, 2026 - 02:15 vuln.today

CVE Published

Mar 29, 2026 - 01:24 nvd

MEDIUM 6.4

DescriptionCVE.org

The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting (XSS) in Twentig Supercharged Block Editor plugin for WordPress versions up to 1.9.7 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'featuredImageSizeWidth' parameter, which executes in the browsers of all users who view affected pages. The vulnerability stems from insufficient input sanitization and output escaping. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The vulnerability exploits improper handling of the 'featuredImageSizeWidth' parameter in the Twentig plugin, a WordPress extension that provides an enhanced block editor with custom blocks, patterns, and design tools. WordPress plugins operate within the WordPress ecosystem and interact directly with the database and page rendering pipeline. When user input reaches the front-end without proper escaping (conversion of special characters to HTML entities), attackers can inject malicious JavaScript that the browser interprets as legitimate code. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which represents the classic stored XSS attack vector where unsanitized input is saved to the database and later rendered to other users without encoding.

RemediationAI

WordPress administrators should immediately update the Twentig plugin to version 1.9.8 or later, which addresses the insufficient input sanitization and output escaping. Users can update via the WordPress dashboard (Plugins > Installed Plugins > Twentig > Update Now) or manually download the patched version from the official WordPress plugin repository. As a temporary mitigation prior to patching, restricting Contributor-level access to only trusted team members reduces the attack surface, though this is not a complete remediation. The WordPress plugin repository changeset 3486634 contains the upstream fix details. Site administrators should also audit existing pages for injected content after patching, as any malicious scripts inserted by compromised contributor accounts will remain in the database until manually removed.