What is the CVSS score of CVE-2026-4067?

CVE-2026-4067 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4067?

Organizations using all should be aware of moderate risk from CVE-2026-4067, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4067?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4067

EUVD-2026-13999 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-43fr-2m4w-5h7x

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13999

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ad Short plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ad' shortcode's 'client' attribute in all versions up to and including 2.0.1. This is due to insufficient input sanitization and output escaping on the 'client' shortcode attribute. The ad_func() shortcode handler at line 71 accepts a 'client' attribute via shortcode_atts() and directly concatenates it into a double-quoted HTML attribute (data-ad-client) at line 130 without applying esc_attr() or any other sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The Ad Short WordPress plugin versions up to 2.0.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'ad' shortcode's 'client' attribute that allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript code into pages. The vulnerability results from insufficient input sanitization and output escaping in the ad_func() shortcode handler, which directly concatenates user-supplied input into HTML attributes without applying proper escaping functions like esc_attr(). When affected pages are visited by other users, the injected scripts execute in their browsers, potentially enabling session hijacking, credential theft, or malware distribution.

Technical ContextAI

The vulnerability exists in the Ad Short plugin (CPE: cpe:2.3:a:nocaredev:ad_short:*:*:*:*:*:*:*:*), which provides WordPress shortcode functionality for embedding advertisements. Specifically, the ad_func() shortcode handler at line 71 receives the 'client' attribute via the shortcode_atts() WordPress function, which parses shortcode parameters. At line 130, this unsanitized 'client' value is directly concatenated into a double-quoted HTML attribute (data-ad-client) without applying WordPress security functions. This violates CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of vulnerability where untrusted input reaches output encoding points without proper escaping. The root cause is the absence of esc_attr() or equivalent sanitization between input reception and HTML output, allowing attackers to break out of the attribute context and inject malicious script tags or event handlers.

RemediationAI

Update the Ad Short plugin to the latest patched version provided by nocaredev immediately; check the WordPress Plugin Repository and Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/313d2749-7662-4870-b0f7-19253797f833?source=cve) for patch availability and release notes. The remediation requires applying esc_attr() to the 'client' attribute value before output at line 130 and sanitizing the input via sanitize_text_field() or similar WordPress sanitization functions during the shortcode_atts() processing. Until a patch is available, administrators should restrict Contributor-level access to only fully trusted users, audit existing posts and pages for suspicious 'ad' shortcodes, and consider using a Web Application Firewall (WAF) to block requests containing script tags or event handlers in shortcode attributes. Additionally, review WordPress user roles and capabilities to ensure only Editor and Administrator roles can publish content.