EUVD-2026-16083
GHSA-2vv2-mqg3-3j3p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates moderate severity with network accessibility, low attack complexity, and low privilege requirements (Contributor level), but the lack of EPSS score, KEV designation, and public proof-of-concept limits quantifiable exploitation probability assessment. The stored XSS nature is more severe than reflected XSS as it affects all page visitors repeatedly; however, the requirement for authenticated Contributor-level access constrains the attacker pool to registered WordPress users with publishing capabilities. This represents a realistic but not critical threat for WordPress sites with permissive user roles or where Contributor accounts are widely distributed. The true risk depends heavily on site-specific access controls and whether plugins are actively maintained-Wordfence's tracking suggests this remains an unpatched issue in live deployments. |
| Exploit ScenarioDerived | An attacker with WordPress Contributor access (either via a compromised account or intentional internal malicious actor) creates or edits a page containing the vulnerable shortcode with a crafted payload such as [baf_sbox sbox_id='test" onmouseover="alert(1)'], which breaks out of the HTML attribute context and injects an event handler. When any site visitor views the page, the malicious script executes in their browser session, potentially harvesting authentication cookies, redirecting to a phishing site, or modifying page content. The attack persists until the page is manually cleaned or the plugin is patched, affecting all subsequent visitors without requiring further attacker involvement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The BWL Advanced FAQ Manager Lite WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'baf_sbox' shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code through shortcode attributes (sbox_id, sbox_class, placeholder, highlight_color, highlight_bg, cont_ext_class) that will execute in the browsers of all users viewing the affected pages. The vulnerability affects all versions up to and including 1.1.1, and while no public exploit code or KEV designation is currently documented, the CVSS 6.4 score and straightforward nature of the flaw indicate moderate real-world risk.
RemediationAI
Immediately upgrade the BWL Advanced FAQ Manager Lite plugin to the latest available version if a patch has been released beyond 1.1.1; check the official WordPress plugin repository and Wordfence advisories for patch status. Until patching is available, remove or deactivate the plugin if it is not critical to site functionality. For sites that must continue using the plugin, restrict Contributor-level access to trusted users only, implement WordPress user role management to limit who can create or edit posts with shortcodes, and consider using a Web Application Firewall (WAF) to detect and block inline script injections in page content. Additionally, conduct a security audit of any posts or pages using the 'baf_sbox' shortcode to identify and remediate any previously injected malicious code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the baf_sbox() function within the WordPress plugin framework (identified via CPE as cpe:2.3:a:xenioushk:bwl_advanced_faq_manager_lite), where shortcode attributes are directly interpolated into HTML element attributes without proper escaping using WordPress's esc_attr() function. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental output encoding failure. The plugin processes user-controlled shortcode parameters and renders them directly in page HTML, allowing attackers to break out of HTML attribute context and inject malicious script tags or event handlers. The references to trunk and version 1.1.1 code at plugins.trac.wordpress.org demonstrate the persistence of this flaw across multiple plugin versions.
Know when Bwl Advanced Faq Manager Lite gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Executive ViewAI
Organizations using all should be aware of moderate risk from CVE-2026-4075, a cross-site scripting vulnerability rated CVSS 6.4. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB