What is the CVSS score of CVE-2026-4075?

CVE-2026-4075 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4075?

Organizations using all should be aware of moderate risk from CVE-2026-4075, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4075?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4075

EUVD-2026-16083 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 Wordfence

GHSA-2vv2-mqg3-3j3p

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 03:45 euvd

EUVD-2026-16083

Analysis Generated

Mar 26, 2026 - 03:45 vuln.today

CVE Published

Mar 26, 2026 - 02:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The BWL Advanced FAQ Manager Lite WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'baf_sbox' shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript code through shortcode attributes (sbox_id, sbox_class, placeholder, highlight_color, highlight_bg, cont_ext_class) that will execute in the browsers of all users viewing the affected pages. The vulnerability affects all versions up to and including 1.1.1, and while no public exploit code or KEV designation is currently documented, the CVSS 6.4 score and straightforward nature of the flaw indicate moderate real-world risk.

Technical ContextAI

The vulnerability exists in the baf_sbox() function within the WordPress plugin framework (identified via CPE as cpe:2.3:a:xenioushk:bwl_advanced_faq_manager_lite), where shortcode attributes are directly interpolated into HTML element attributes without proper escaping using WordPress's esc_attr() function. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a fundamental output encoding failure. The plugin processes user-controlled shortcode parameters and renders them directly in page HTML, allowing attackers to break out of HTML attribute context and inject malicious script tags or event handlers. The references to trunk and version 1.1.1 code at plugins.trac.wordpress.org demonstrate the persistence of this flaw across multiple plugin versions.

RemediationAI

Immediately upgrade the BWL Advanced FAQ Manager Lite plugin to the latest available version if a patch has been released beyond 1.1.1; check the official WordPress plugin repository and Wordfence advisories for patch status. Until patching is available, remove or deactivate the plugin if it is not critical to site functionality. For sites that must continue using the plugin, restrict Contributor-level access to trusted users only, implement WordPress user role management to limit who can create or edit posts with shortcodes, and consider using a Web Application Firewall (WAF) to detect and block inline script injections in page content. Additionally, conduct a security audit of any posts or pages using the 'baf_sbox' shortcode to identify and remediate any previously injected malicious code.