What is the CVSS score of CVE-2026-4086?

CVE-2026-4086 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4086?

Organizations using all should be aware of moderate risk from CVE-2026-4086, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4086?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4086

EUVD-2026-14010 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-x5f6-m38m-6rp5

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14010

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the random_button_html() function directly concatenates the 'cat' and 'nocat' parameters into HTML data-attributes without esc_attr(), and the 'text' parameter into HTML content without esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The WP Random Button WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.0 affecting all installations of this plugin. Authenticated attackers with Contributor-level or higher privileges can inject arbitrary JavaScript code through improperly sanitized shortcode attributes ('cat', 'nocat', and 'text'), which will execute in the browsers of any user viewing the affected pages. With a CVSS score of 6.4 and network-accessible attack vector requiring only low-privileged authenticated access, this vulnerability poses a moderate but realistic risk to WordPress sites using this plugin, particularly those with contributor-level user accounts or where user roles are not carefully managed.

Technical ContextAI

The vulnerability stems from insufficient input sanitization and output escaping in the random_button_html() function of the WP Random Button plugin (CPE: cpe:2.3:a:newbiesup:wp_random_button:*:*:*:*:*:*:*:*). The plugin processes WordPress shortcode attributes ('cat', 'nocat', and 'text') and directly concatenates them into HTML without using WordPress security functions. Specifically, the 'cat' and 'nocat' parameters are inserted into HTML data-attributes without the esc_attr() function, while the 'text' parameter is concatenated into HTML content without esc_html() escaping. This is a classic instance of CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled input flows directly into the output context without proper encoding for that context. The vulnerability is particularly severe because shortcodes are stored content—once injected via the post/page editor, the malicious script persists in the database and executes for all subsequent page views, making this a Stored XSS rather than Reflected XSS.

RemediationAI

The primary remediation is to update the WP Random Button plugin to a patched version beyond 1.0 if and when such a patch is released by the plugin maintainer (newbiesup); site administrators should monitor the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/0b9e11f5-5a05-4867-abd8-fb07c84a49b0) for patch availability. Until a patch is available, disable or remove the WP Random Button plugin entirely if it is not critical to site functionality. As an interim preventive control, restrict Contributor-level and above role assignments to trusted administrators only, and audit existing posts and pages using the wp_random_button shortcode for any suspicious attribute values that may have already been injected. Additionally, implement WordPress security hardening measures such as Web Application Firewall (WAF) rules to block requests containing common XSS payloads in shortcode attributes, and enable Content Security Policy (CSP) headers to mitigate the impact if XSS injection occurs despite preventive measures.