What is the CVSS score of CVE-2026-3659?

CVE-2026-3659 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-3659

EUVD-2026-22863 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Wordfence

GHSA-jxvc-xjm6-c4gc

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:08 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22863

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [circliful] shortcode and via multiple shortcode attributes of the [circliful_direct] shortcode in all versions up to and including 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, in the circliful_shortcode() function, the 'id' attribute value is concatenated directly into an HTML id attribute (line 285) without any escaping, allowing an attacker to break out of the double-quoted attribute and inject arbitrary HTML event handlers. Similarly, the circliful_direct_shortcode() function (line 257) outputs all shortcode attributes directly into HTML data-* attributes without escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP Circliful plugin for WordPress up to version 1.2 allows authenticated attackers with Contributor-level access to inject arbitrary HTML and JavaScript via insufficiently sanitized shortcode attributes in [circliful] and [circliful_direct] shortcodes. The vulnerability exists in the circliful_shortcode() and circliful_direct_shortcode() functions, which concatenate user input directly into HTML attributes without escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser. No public exploit code or active exploitation in the wild has been confirmed at time of analysis.

Technical ContextAI

The WP Circliful plugin (cpe:2.3:a:bappidgreat:wp_circliful:*:*:*:*:*:*:*:*) is a WordPress plugin that implements shortcode handlers to render circular progress indicators. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation, a.k.a. Cross-site Scripting). Specifically, the circliful_shortcode() function at line 285 and the circliful_direct_shortcode() function at lines 257 and 263 fail to apply proper output escaping when constructing HTML attributes from user-supplied shortcode parameters. The 'id' attribute in [circliful] and all data-* attributes in [circliful_direct] are populated with unescaped values, allowing attackers to break out of quoted attribute context and inject event handlers or arbitrary HTML elements. WordPress provides escaping functions like esc_attr() and esc_html() that should have been applied but were omitted.

RemediationAI

Update the WP Circliful plugin to a version newer than 1.2 if the vendor has released a patch. Website administrators should immediately deactivate and remove the plugin if no update is available. If continued use is necessary pending a patch, restrict Contributor-level access or higher to trusted users only, and audit existing posts and pages for malicious shortcodes. The underlying fix requires applying WordPress escaping functions (esc_attr() for HTML attributes, esc_html() for text content) to all user-supplied shortcode parameters before output. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/030534e2-bf7d-42e4-94a1-986f629bea15?source=cve for additional guidance and confirmation of patched versions when available.