What is the CVSS score of CVE-2026-4279?

CVE-2026-4279 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Bread & Butter WordPress Plugin CVE-2026-4279

EUVD-2026-24686 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-g8vq-gpv7-9mmq

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 09:58 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24686

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Bread & Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'breadbutter-customevent-button' shortcode in all versions up to, and including, 8.2.0.25. This is due to insufficient input sanitization and output escaping on the 'event' shortcode attribute. The customEventShortCodeButton() function takes the 'event' attribute value and directly interpolates it into a JavaScript string within an onclick HTML attribute without applying esc_attr() or esc_js(). Notably, the sister function customEventShortCode() properly uses esc_js() for the same attribute, but this was omitted in the button variant. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page and clicks the injected button.

AnalysisAI

Stored cross-site scripting in Bread & Butter plugin for WordPress up to version 8.2.0.25 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'event' attribute of the 'breadbutter-customevent-button' shortcode. The vulnerability arises from missing output escaping in the customEventShortCodeButton() function, which directly interpolates unsanitized user input into an onclick HTML attribute. Scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malicious content injection.

Technical ContextAI

The Bread & Butter plugin implements shortcode functionality for WordPress via the customEventShortCodeButton() and customEventShortCode() functions in src/Base/Shortcode.php. Both functions accept an 'event' attribute intended to specify JavaScript event handlers. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from the button variant failing to apply WordPress escaping functions when constructing the onclick attribute, whereas the sister function correctly uses esc_js(). The vulnerability affects the shortcode parser's attribute interpolation, which occurs server-side during page rendering but executes client-side JavaScript in user browsers. CPE data indicates the vulnerable product is 'breadbutter:bread_&_butter:_ai-powered_lead_intelligence' across all versions up to 8.2.0.25.

RemediationAI

Update Bread & Butter plugin to a version newer than 8.2.0.25 as soon as available (exact patched version not confirmed in provided data-check WordPress plugin repository for latest release). The fix requires the plugin developers to apply esc_js() or esc_attr() escaping to the 'event' attribute in customEventShortCodeButton(), mirroring the correct implementation in customEventShortCode(). In the interim, WordPress administrators can mitigate risk by restricting Contributor-level role assignment to trusted users only; audit existing Contributor accounts and demote unnecessary ones. Additionally, remove or replace any existing 'breadbutter-customevent-button' shortcodes from published pages and posts until patched, as malicious instances may persist in page revision history. Site administrators using plugins like Wordfence can enable Web Application Firewall rules to block inline onclick event injection patterns. These compensating controls reduce but do not eliminate risk, as determined attackers with Contributor access can still craft payloads. Upgrading to the patched version remains the definitive fix.