What is the CVSS score of CVE-2026-4072?

CVE-2026-4072 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4072?

Organizations using all should be aware of moderate risk from CVE-2026-4072, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4072?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4072

EUVD-2026-14177 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-jxp3-mpj8-9vw7

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14177

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode', and 'image'. The wordpress_paypal_donation_create() function uses extract(shortcode_atts(...)) to process shortcode attributes and then directly interpolates these values into HTML output within single-quoted attribute values without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the WordPress PayPal Donation plugin (all versions up to and including 1.01) due to insufficient input sanitization and output escaping in shortcode attribute handling. Authenticated attackers with Contributor-level access or above can inject arbitrary JavaScript code through malicious shortcode attributes that will execute for all users viewing the affected pages. With a CVSS score of 6.4 and confirmed vulnerability details available through Wordfence and WordPress plugin repository source code analysis, this represents a moderate but practical risk to WordPress installations using this plugin.

Technical ContextAI

The vulnerability stems from improper handling of shortcode attributes in the wordpress_paypal_donation_create() function, which violates CWE-79 (Improper Neutralization of Input During Web Page Generation). The vulnerable code uses extract(shortcode_atts(...)) to process user-supplied shortcode parameters including 'amount', 'email', 'title', 'return_url', 'cancel_url', 'ccode', and 'image', then directly interpolates these values into HTML single-quoted attribute values without applying WordPress escaping functions such as esc_attr() or esc_url(). This allows attackers to break out of attribute context and inject arbitrary HTML and JavaScript. The affected product is the WordPress PayPal Donation plugin by tstachl, identified via CPE cpe:2.3:a:tstachl:wordpress_paypal_donation:*:*:*:*:*:*:*:*, which is distributed through the official WordPress plugin repository.

RemediationAI

The primary remediation is to update the WordPress PayPal Donation plugin to a patched version once available from the plugin developer. Users should check the WordPress plugin repository for an updated release that properly escapes shortcode attributes using WordPress-standard functions like esc_attr() and esc_url(). Until a patch is released, site administrators should either disable the plugin entirely or restrict the creation and editing of pages containing PayPal Donation shortcodes to trusted administrators only by limiting Contributor role capabilities through role management plugins. Additionally, implement Web Application Firewall (WAF) rules to detect and block script injection attempts in shortcode parameters, and monitor the WordPress plugin repository and Wordfence for patch notifications at https://www.wordfence.com/threat-intel/vulnerabilities/id/99a8b48b-2967-4179-a0eb-626bbe273f03.