What is the CVSS score of CVE-2026-2986?

CVE-2026-2986 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-2986

EUVD-2026-23674 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-18 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 18, 2026 - 11:40 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 11:30 euvd

EUVD-2026-23674

Analysis Generated

Apr 18, 2026 - 11:30 vuln.today

CVE Published

Apr 18, 2026 - 11:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Contextual Related Posts plugin for WordPress (versions up to 4.2.1) allows authenticated contributors and above to inject malicious scripts via the 'other_attributes' parameter, which execute in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, enabling privilege escalation from contributor-level access to site-wide code execution. No active exploitation in the wild has been confirmed, but the attack requires only authenticated access at a low privilege level that is commonly granted in WordPress environments.

Technical ContextAI

The Contextual Related Posts plugin (cpe:2.3:a:ajay:contextual_related_posts:*:*:*:*:*:*:*:*) is a WordPress plugin that displays related content on pages and posts. The vulnerability resides in the handling of the 'other_attributes' parameter, which is passed to HTML rendering functions without proper sanitization (via functions like wp_kses, sanitize_text_field, or equivalent escaping) or output escaping (via wp_esc_attr or similar). CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-controlled input is incorporated into HTML/JavaScript context without neutralizing special characters that enable script injection. In a WordPress context, this allows attackers to break out of attribute contexts or inject script tags that bypass browser same-origin policies when the page is rendered.

RemediationAI

Vendor-released patch: versions 4.2.2 and above. Upgrade the Contextual Related Posts plugin to the latest version (4.2.2 or later) through the WordPress plugin dashboard or via the plugin repository. Verify the changeset at https://plugins.trac.wordpress.org/changeset/3481684/contextual-related-posts to confirm the fix includes sanitization of the 'other_attributes' parameter using wp_kses_post() or wp_esc_attr() and output escaping where the parameter is rendered. As an interim compensating control for environments where immediate patching is not feasible, restrict contributor-level and higher role access to trusted users only; audit existing contributor accounts and revoke access for inactive or suspicious accounts. Additionally, implement a Web Application Firewall (WAF) rule to block POST/PUT requests containing 'other_attributes' parameters with suspicious patterns (e.g., '<script', 'javascript:', event handlers like 'onclick'). Note that WAF mitigation adds latency and may produce false positives if legitimate content uses special characters; the primary remediation remains upgrading to the patched version.