What is the CVSS score of CVE-2026-4022?

CVE-2026-4022 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4022?

Organizations using all should be aware of moderate risk from CVE-2026-4022, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4022?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4022

EUVD-2026-14146 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-2rgw-rqcx-h77r

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14146

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Show Posts list - Easy designs, filters and more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_type' shortcode attribute in the 'swiftpost-list' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user-supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Show Posts List plugin for WordPress (versions up to 1.1.0) affecting the 'swiftpost-list' shortcode's 'post_type' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level privileges or higher can inject arbitrary JavaScript code into pages, which executes whenever any user views the compromised page. With a CVSS score of 6.4 and network-accessible attack vector requiring only low privileges, this represents a moderate-priority vulnerability for WordPress installations using this plugin, particularly those with multi-user environments.

Technical ContextAI

This vulnerability stems from improper handling of user-supplied shortcode attributes in the WordPress plugin ecosystem. The 'swiftpost-list' shortcode in the Show Posts List plugin (identified via CPE as cpe:2.3:a:creativedev4:show_posts_list_–_easy_designs,_filters_and_more) fails to implement adequate input sanitization via WordPress sanitization functions (such as sanitize_text_field() or sanitize_key()) and lacks proper output escaping using functions like esc_attr() or wp_kses_post(). The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), a well-established web application flaw category. The vulnerable code paths are visible in post-shortcode.php at multiple lines (21, 43, 103, 119), where the 'post_type' attribute and potentially other shortcode parameters are directly echoed or processed without escaping, allowing an attacker to break out of attribute contexts and inject malicious script tags.

RemediationAI

Update the Show Posts List plugin to a version newer than 1.1.0 immediately; check the official WordPress plugin repository or the vendor's website for patched versions (patches addressing CWE-79 input sanitization and output escaping issues should be available). If a patched version is not yet available from the vendor, disable or remove the plugin until a fix is released, as the vulnerability affects core shortcode functionality. As an interim control, restrict contributor-level account creation and limit contributor permissions to users who absolutely require them, audit existing contributors for suspicious account activity, and monitor page revisions for unexpected shortcode modifications. Additionally, implement WordPress security hardening by using Web Application Firewall (WAF) rules to detect and block shortcode attribute payloads containing script tags, and enable WordPress security plugins that provide XSS detection. For detailed vulnerability information and advisory tracking, refer to the Wordfence report linked above.