What is the CVSS score of CVE-2026-4088?

CVE-2026-4088 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Switch CTA Box CVE-2026-4088

EUVD-2026-24652 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-6jwx-v327-2xh9

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24652

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. The shortcode reads post meta from a user-specified post ID and echoes these values directly into HTML output without any escaping functions (no esc_attr(), esc_url(), or esc_html()). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Switch CTA Box WordPress plugin up to version 1.1 allows authenticated contributors and above to inject arbitrary JavaScript through unsanitized post meta fields including button link, button ID, button text, and description. The vulnerability arises from direct output of user-supplied data into HTML without escaping functions, enabling attackers to execute malicious scripts whenever pages containing injected shortcodes are accessed by any visitor.

Technical ContextAI

The vulnerability exists in the WordPress plugin's shortcode handler, which retrieves post metadata fields (cta_box_button_link, cta_box_button_id, cta_box_button_text, cta_box_description) via the 'wppw_cta_box' shortcode and renders them directly into HTML output in box_display_template.php and shortcode_setup.php without invoking WordPress security functions such as esc_attr(), esc_url(), or esc_html(). This is a classic Stored XSS vulnerability (CWE-79) where malicious input persists in the WordPress post meta database and executes in the browser context of all page visitors, not just the injector. The attack surface is limited to authenticated users with contributor-level permissions or higher, who can modify post metadata or create posts using the vulnerable shortcode.

RemediationAI

Update Switch CTA Box plugin to version 1.2 or later (version number inferred from typical WordPress plugin versioning; verify current stable release on plugins.wordpress.org). The patch should include proper input sanitization via sanitize_text_field() or sanitize_url() for post meta on save, and output escaping via esc_attr(), esc_url(), and esc_html() in box_display_template.php and shortcode_setup.php before echoing meta values. If an immediate patch is unavailable, restrict contributor role access via role/capability plugins or disable the 'wppw_cta_box' shortcode entirely using remove_shortcode( 'wppw_cta_box' ) in functions.php as a temporary measure, accepting loss of plugin functionality. Monitor for plugin updates at https://plugins.wordpress.org/plugins/switch-cta-box/ and review code commits on https://plugins.trac.wordpress.org/browser/switch-cta-box/.