What is the CVSS score of CVE-2026-3554?

CVE-2026-3554 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-3554?

Organizations using all should be aware of moderate risk from CVE-2026-3554, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3554?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-3554

EUVD-2026-14162 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-x8x7-xgj7-47r4

WordPress PHP XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14162

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Sherk Custom Post Type Displays plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in all versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the 'title' attribute of the 'sherkcptdisplays' shortcode. Specifically, in the sherkcptdisplays_func() function in includes/SherkCPTDisplaysShortcode.php, the 'title' attribute value is extracted from shortcode_atts() on line 19 and directly concatenated into an HTML <h2> tag on line 31 without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Sherk Custom Post Type Displays WordPress plugin (versions up to 1.2.1) where the 'title' shortcode attribute is insufficiently sanitized and directly concatenated into HTML output without escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes for all users viewing affected pages. The vulnerability has a CVSS score of 6.4 (Medium) with a local privilege requirement, making it exploitable by lower-privileged authenticated users rather than unauthenticated remote attackers.

Technical ContextAI

The vulnerability is a classic Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in PHP-based WordPress plugin architecture. The affected product is identified via CPE as cpe:2.3:a:sherkspear:sherk_custom_post_type_displays:*:*:*:*:*:*:*:*, specifically in the sherkcptdisplays_func() function within includes/SherkCPTDisplaysShortcode.php. The root cause occurs at line 19 where the 'title' shortcode attribute is extracted via shortcode_atts() without sanitization, and at line 31 where it is directly concatenated into an HTML h2 tag without output escaping using WordPress standard functions like esc_html(). This violates WordPress security best practices which require both input validation and output escaping as separate layers of defense.

RemediationAI

The primary remediation is to upgrade the Sherk Custom Post Type Displays plugin to a version later than 1.2.1 once a patch is released by the vendor. The vulnerability requires output escaping of the 'title' attribute using WordPress's esc_html() function before concatenation into the h2 tag on line 31, and input sanitization via sanitize_text_field() at line 19. Until a patched version is available, site administrators should disable or remove the plugin, restrict Contributor-level user accounts to only those absolutely trusted, and implement a Web Application Firewall (WAF) rule to detect and block shortcode attributes containing script tags or event handlers. For sites that cannot immediately patch, monitoring tools such as Wordfence (which reported this vulnerability) can be used to detect exploitation attempts. The vendor advisory is referenced at https://www.wordfence.com/threat-intel/vulnerabilities/id/d227d4e4-2899-434c-8b93-8d93a89b1b1b?source=cve.