What is the CVSS score of CVE-2026-4025?

CVE-2026-4025 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4025

EUVD-2026-20431 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-3w3c-w6r8-vrjc

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 10:00 euvd

EUVD-2026-20431

Analysis Generated

Apr 08, 2026 - 10:00 vuln.today

CVE Published

Apr 08, 2026 - 09:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the 'align' attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in PrivateContent Free WordPress plugin versions up to 1.2.0 allows authenticated contributors and above to inject arbitrary JavaScript through the 'align' shortcode attribute in [pc-login-form], which executes when any user visits an affected page. The vulnerability stems from the 'align' parameter being concatenated directly into an HTML class attribute without proper escaping (esc_attr), enabling persistent XSS attacks. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture, specifically within the [pc-login-form] shortcode implementation. The PrivateContent Free plugin (CPE: cpe:2.3:a:lcweb-projects:privatecontent_free:*:*:*:*:*:*:*:*) processes the 'align' shortcode attribute through the pc_login_form() function, which passes the unsanitized value to pc_static::form_align(). This function concatenates the attribute directly into an HTML class attribute without applying WordPress's esc_attr() escaping function, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). The flaw represents a classic stored XSS where user-supplied input from shortcode attributes is rendered in the DOM without proper output encoding, allowing script injection in pages containing the vulnerable shortcode.

RemediationAI

Update the PrivateContent Free plugin to a version patched after 1.2.0 immediately; check the plugin repository or the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a9ed2943-e108-49e3-ba16-f74ce3136bde for the current patched release. The upstream fix should implement esc_attr() escaping on the 'align' attribute within the form_align() function before concatenating it into the HTML class attribute. Until patched, administrators can audit existing [pc-login-form] shortcodes on published pages for suspicious 'align' attribute values (inspect pages via wp-admin or database queries), remove or sanitize compromised instances, and restrict Contributor-level user creation to trusted individuals. Review user roles and capabilities to ensure only necessary personnel possess publishing permissions.