What is the CVSS score of CVE-2026-3885?

CVE-2026-3885 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-3885

EUVD-2026-23159 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

GHSA-99qg-46r6-v9px

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 16, 2026 - 02:51 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 02:45 euvd

EUVD-2026-23159

Analysis Generated

Apr 16, 2026 - 02:45 vuln.today

CVE Published

Apr 16, 2026 - 02:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_box' shortcode in all versions up to, and including, 7.4.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.9 allows authenticated contributors and above to inject arbitrary JavaScript into WordPress pages via the 'su_box' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users who access the affected pages, potentially compromising site visitors' sessions and data. No public exploit code has been identified at the time of analysis, though the vulnerability is straightforward to reproduce and weaponize.

Technical ContextAI

The vulnerability exists in the su_box shortcode handler, which processes user-supplied shortcode attributes without properly sanitizing input or escaping output when rendering HTML. The WP Shortcodes Plugin - Shortcodes Ultimate (CPE: cpe:2.3:a:gn_themes:wp_shortcodes_plugin_-_shortcodes_ultimate) is a WordPress plugin that provides content creation shortcodes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web vulnerability class where user-controlled data is embedded directly into HTML output without encoding special characters. In WordPress context, this means shortcode attributes passed by authenticated users are rendered as-is into page markup, allowing attackers to break out of attribute contexts and inject script tags or event handlers. The shortcode processing occurs server-side, but the malicious payload is stored in the WordPress database and delivered to all subsequent page visitors, making this a stored XSS rather than reflected.

RemediationAI

The primary remediation is to upgrade the WP Shortcodes Plugin - Shortcodes Ultimate to a patched version released after 7.4.9. A fix has been released as indicated by the WordPress plugin changeset reference (https://plugins.trac.wordpress.org/changeset/3489360/shortcodes-ultimate); users should update to the latest version available in the WordPress plugin repository. If immediate patching is not possible, mitigate the risk by restricting contributor-level access to only trusted staff members and regularly audit existing posts/pages for suspicious shortcode usage, particularly the su_box shortcode with unusual attributes. Additionally, consider disabling the su_box shortcode if it is not actively used by implementing a custom filter in your theme's functions.php to remove the shortcode. Monitor user activity logs and review recent post revisions for unexpected changes to su_box usage. These compensating controls reduce but do not eliminate risk, so patching should be prioritized.