What is the CVSS score of CVE-2026-4069?

CVE-2026-4069 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-4069?

Organizations using all should be aware of moderate risk from CVE-2026-4069, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-4069?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4069

EUVD-2026-13991 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-pmq6-5285-2f6f

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13991

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.1

DescriptionCVE.org

The Alfie - Feed Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'naam' parameter in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the alfie_option_page() function combined with insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject malicious web scripts that will be stored in the plugin's database and execute whenever a user accesses the page displaying the injected data, granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Alfie - Feed Plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'naam' parameter of the alfie_option_page() function, affecting all versions up to and including 1.2.1. The vulnerability stems from missing nonce validation combined with insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that persist in the plugin's database and execute when users view affected pages. An attacker must successfully social engineer a site administrator into clicking a malicious link, but once exploited, the payload executes with the privileges of any user accessing the compromised page, making this a moderate-risk vulnerability with a CVSS score of 6.1.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), which occurs when user input is not properly sanitized before being stored and rendered in the browser. The affected product, identified via CPE as cpe:2.3:a:pftool:alfie_–_feed_plugin:*:*:*:*:*:*:*:*, is a WordPress plugin that handles product feed management. The root cause involves two critical security failures in the alfie-option.php file (lines 59-60 and 75): the alfie_option_page() function lacks WordPress nonce verification (used to prevent Cross-Site Request Forgery), and the 'naam' parameter is processed without proper sanitization before database storage or escaping before output rendering. WordPress provides built-in functions like sanitize_text_field() for input sanitization and esc_html() or esc_attr() for output escaping that should be employed but are absent in this implementation.

RemediationAI

WordPress site administrators must upgrade the Alfie – Feed Plugin to a version newer than 1.2.1 immediately, as that version is the last confirmed vulnerable release (verify availability of patched version through the official WordPress plugin repository at plugins.wordpress.org/alfie-the-productfeedtool-wp-plugin). Until a patch is available or deployed, administrators should deactivate and remove the plugin entirely if not in active use, or if the plugin is critical to operations, restrict administrative access to the plugin settings page through WordPress user capability restrictions and implement Web Application Firewall (WAF) rules to detect and block stored XSS payloads in POST requests to the affected parameter. Additionally, regular security audits of the WordPress database should be performed to identify any existing malicious 'naam' parameter values that may have been injected and subsequently removed via database cleanup scripts.