What is the CVSS score of CVE-2026-3600?

CVE-2026-3600 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3600

EUVD-2026-20041 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-rcpv-9747-gv3q

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20041

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 04:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Investi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'investi-announcements-accordion' shortcode's 'maximum-num-years' attribute in all versions up to, and including, 1.0.26. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the 'maximum-num-years' attribute value is read directly from shortcode attributes and interpolated into a double-quoted HTML attribute without any escaping (no esc_attr(), htmlspecialchars(), or similar). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Investi WordPress plugin versions up to 1.0.26 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through the 'maximum-num-years' attribute of the 'investi-announcements-accordion' shortcode. The vulnerability stems from insufficient input sanitization and output escaping, enabling persistent XSS payloads that execute when users access affected pages. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The Investi plugin (cpe:2.3:a:investi:investi:*:*:*:*:*:*:*:*) processes WordPress shortcodes, specifically the 'investi-announcements-accordion' shortcode. The 'maximum-num-years' attribute value is read directly from shortcode parameters and concatenated into a double-quoted HTML attribute without any escaping functions (such as esc_attr(), htmlspecialchars(), or equivalent). This is a textbook Stored Cross-Site Scripting (CWE-79) vulnerability. The root cause is the failure to apply WordPress's standard sanitization and escaping APIs when handling user-supplied shortcode attributes. An attacker can craft a shortcode with a malicious payload in the 'maximum-num-years' attribute; when the page is rendered, the unescaped attribute value breaks out of the HTML context and executes JavaScript in the browser of any user viewing that page.

RemediationAI

Update the Investi plugin to a patched version released after 1.0.26. Administrators should navigate to Plugins > Installed Plugins in the WordPress admin panel, check for available updates to Investi, and click 'Update Now' if available. If a patched version is not yet released, restrict Contributor-level access to only trusted users, or temporarily disable the 'investi-announcements-accordion' shortcode until a patch is available. For technical confirmation of remediation status and specific patched version numbers, consult the Wordfence vulnerability report (https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa0d86-e623-46d1-9d37-a36b4825c071?source=cve) and monitor the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset/3486937/) for repository updates.