What is the CVSS score of CVE-2026-4084?

CVE-2026-4084 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4084?

Organizations using all should be aware of moderate risk from CVE-2026-4084, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4084?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4084

EUVD-2026-13994 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-fm6h-hmg3-46c3

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13994

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in all versions up to, and including, 0.3.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'color', 'podcast_id', and 'podcast_slug'. These attributes are directly concatenated into inline JavaScript within single-quoted string arguments without any escaping or sanitization, allowing an attacker to break out of the JavaScript string context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The fyyd podcast shortcodes plugin for WordPress contains a Stored Cross-Site Scripting vulnerability affecting all versions up to and including 0.3.1, where shortcode attributes (color, podcast_id, podcast_slug) are improperly concatenated into inline JavaScript without sanitization or escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes for all users viewing affected pages, allowing session hijacking, credential theft, or malware distribution. The CVSS 6.4 score reflects moderate risk with network-accessible attack vector and low complexity, though exploitation requires prior authentication.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, a classic Stored XSS), where user-supplied shortcode attributes are directly concatenated into JavaScript string literals within HTML inline event handlers without proper escaping or sanitization. The affected product is the fyyd podcast shortcodes plugin for WordPress (CPE: cpe:2.3:a:cbednarek:fyyd_podcast_shortcodes:*:*:*:*:*:*:*:*), developed by cbednarek. The vulnerability exists across multiple handler functions that process [fyyd-podcast], [fyyd-episode], and [fyyd] shortcodes. The root cause is the failure to escape single-quote characters and JavaScript-special characters in attributes before embedding them in inline JavaScript contexts, allowing attackers to break out of the intended string scope and inject arbitrary code.

RemediationAI

If a patched version is available from the plugin developer, upgrade fyyd podcast shortcodes to the latest version immediately via the WordPress Plugins dashboard. If no patch exists or the plugin is abandoned, disable and remove the plugin entirely, then replace its functionality with alternative podcast shortcode plugins from trusted developers with active maintenance. As a temporary control if removal is infeasible, restrict Contributor-level account creation and audit existing Contributors for suspicious posts containing malicious shortcode attributes. Additionally, implement WordPress security hardening via security plugins (Wordfence, Sucuri) to detect and block XSS payloads, and enable Content Security Policy (CSP) headers to mitigate inline script execution. Monitor the Wordfence vulnerability advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/3f9d57ae-b238-43db-8eee-ccab499b1cbc?source=cve) and WordPress plugin repository for updates.