What is the CVSS score of CVE-2026-3619?

CVE-2026-3619 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3619?

Organizations using all should be aware of moderate risk from CVE-2026-3619, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-3619?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3619

EUVD-2026-14183 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-gwmc-j777-wj8p

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14183

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Sheets2Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titles' shortcode attribute in the [sheets2table-render-table] shortcode in all versions up to and including 0.4.1. This is due to insufficient input sanitization and output escaping. Specifically, the 'titles' attribute value from the shortcode is passed through S2T_Functions::trim_array_values() (which only trims whitespace) and then echoed directly into HTML via echo $header inside a <th> tag in the display_table_header() function without any escaping such as esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Sheets2Table WordPress plugin versions up to 0.4.1 contain a Stored Cross-Site Scripting (XSS) vulnerability in the [sheets2table-render-table] shortcode's 'titles' attribute, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the display_table_header() function, where user-supplied shortcode attributes are echoed directly into HTML without proper escaping mechanisms such as esc_html().

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects the Sheets2Table plugin (CPE: cpe:2.3:a:tonyh-1:sheets2table:*:*:*:*:*:*:*:*). The root cause lies in the plugin's shortcode processing pipeline, specifically in the core/sheets2table-shortcodes.php file where the 'titles' shortcode attribute is extracted and passed to the S2T_Functions::trim_array_values() function. This trimming function only removes whitespace and provides no sanitization. The unsanitized value is then directly echoed into HTML table header (<th>) tags via the display_table_header() function in core/class-sheets2table-tables.php at line 122, bypassing WordPress's standard output escaping functions. This represents a failure to apply defense-in-depth principles whereby both input validation and output encoding should be employed to prevent XSS injection in a WordPress context.

RemediationAI

Users of the Sheets2Table plugin should update to the latest patched version as soon as it becomes available from the plugin developer, as official patch status was not confirmed in available intelligence. The primary remediation is to upgrade to a version released after 0.4.1 that includes proper output escaping using WordPress functions such as esc_html() or esc_attr() for the 'titles' shortcode attribute before echoing values into HTML context. Until a patch is available, administrators should restrict the [sheets2table-render-table] shortcode usage to trusted content creators only by limiting Contributor-level and above access to essential personnel, and consider disabling the plugin entirely if it is not actively used. Code-level mitigation involves manually patching the display_table_header() function in core/class-sheets2table-tables.php to wrap the $header variable with esc_html() before output, ensuring that any HTML special characters in user input are properly encoded. Monitor the WordPress plugins repository (https://plugins.trac.wordpress.org/browser/sheets2table/) for patch availability and check Wordfence threat intelligence regularly for confirmed remediation guidance.