What is the CVSS score of CVE-2026-4032?

CVE-2026-4032 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-4032?

Yes, a patch is available for CVE-2026-4032. Update the affected software to the latest version immediately.

WordPress CVE-2026-4032

EUVD-2026-23170 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-16 Wordfence

GHSA-63x8-x938-vx33

GHSA-7xjm-g8f4-rp26

GHSA-83mq-cmhp-6pvq

GHSA-ffq7-898w-9jc4

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 16, 2026 - 08:30 nvd

Patch available

Analysis Generated

Apr 16, 2026 - 04:15 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 04:00 euvd

EUVD-2026-23170

Analysis Generated

Apr 16, 2026 - 04:00 vuln.today

CVE Published

Apr 16, 2026 - 03:36 nvd

MEDIUM 6.1

DescriptionCVE.org

The CodeColorer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter in 'cc' comment shortcode in versions up to, and including, 0.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires comments to be enabled on the target post and guest comments to be allowed.

AnalysisAI

Stored Cross-Site Scripting (XSS) in CodeColorer plugin for WordPress versions up to 0.10.1 allows unauthenticated attackers to inject malicious JavaScript via the 'class' parameter in the 'cc' comment shortcode, which executes in the browsers of users viewing the affected page. Exploitation requires comments to be enabled and guest comments permitted on the target post. The vulnerability has a CVSS score of 6.1 with low complexity and no authentication required, but user interaction (visiting the affected page) is necessary for the payload to execute.

Technical ContextAI

CodeColorer is a WordPress plugin (CPE: cpe:2.3:a:kpumuk:codecolorer:*:*:*:*:*:*:*:*) that provides syntax highlighting functionality through shortcodes. The vulnerability exists in the 'cc' comment shortcode parser, which accepts a 'class' parameter intended for CSS styling. The plugin fails to properly sanitize this parameter before storing it in the database and fails to escape it when outputting to HTML, creating a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The shortcode is processed when comments are rendered, making stored payloads execute in the context of any page containing an infected comment when viewed by site visitors.

RemediationAI

Update the CodeColorer plugin to a patched version released after 0.10.1. The WordPress plugin repository changeset 3481552 indicates a fix is available in the plugin's source code repository; administrators should update through the WordPress plugin management interface or directly from https://plugins.trac.wordpress.org/changeset/3481552/codecolorer. If immediate patching is not possible, disable the CodeColorer plugin until a patch is applied. As a temporary mitigation, disable guest comments on all posts or globally through Settings > Discussion, which prevents unauthenticated attackers from injecting payloads, though this impacts legitimate user engagement. Additionally, review existing comments for suspicious 'class' parameter values in 'cc' shortcodes and delete any that contain angle brackets, quotes, or event handlers (e.g., onclick, onerror). Website administrators can audit for exploitation by searching the database for comment content containing [cc class= followed by suspicious characters or JavaScript keywords.