What is the CVSS score of CVE-2026-4336?

CVE-2026-4336 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-4336

EUVD-2026-20845 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 Wordfence

GHSA-xcgq-hf5p-j85h

WordPress PHP XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 04:30 euvd

EUVD-2026-20845

Analysis Generated

Apr 09, 2026 - 04:30 vuln.today

CVE Published

Apr 09, 2026 - 03:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This is due to the plugin calling html_entity_decode() on post_content during rendering in the set_display_variables() function (View.FAQ.class.php, line 746), which converts HTML entity-encoded payloads back into executable HTML, combined with insufficient output escaping in the faq-answer.php template where the decoded content is echoed without wp_kses_post() or any other sanitization. The ufaq custom post type is registered with 'show_in_rest' => true and defaults to 'post' capability_type, allowing Author-level users to create and publish FAQs via the REST API. An Author can submit entity-encoded malicious HTML (e.g., <img src=x onerror=alert()>) which bypasses WordPress's kses sanitization at save time (since kses sees entities as plain text, not tags), but is then decoded back into executable HTML by html_entity_decode() at render time. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in FAQ pages that will execute whenever a user accesses an injected FAQ, either directly or via the [ultimate-faqs] shortcode.

AnalysisAI

Stored cross-site scripting in Ultimate FAQ Accordion plugin for WordPress (all versions up to 2.4.7) allows authenticated Author-level users to inject arbitrary web scripts into FAQ pages. The vulnerability exploits a double-encoding bypass: the plugin calls html_entity_decode() on FAQ content during rendering, converting entity-encoded payloads (e.g., <img src=x onerror=alert()>) back into executable HTML, which then bypasses WordPress output escaping in the faq-answer.php template. The ufaq custom post type is REST API-enabled with default post capabilities, allowing Authors to create and publish malicious FAQs via REST API. No public exploit code has been identified at time of analysis, but the vulnerability has a moderate CVSS 6.4 score reflecting its authenticated requirement and cross-site impact.

Technical ContextAI

The Ultimate FAQ Accordion plugin processes FAQ content through a PHP rendering pipeline in View.FAQ.class.php (line 746) where set_display_variables() calls html_entity_decode() on post_content. This function converts HTML entities (e.g., <, >, ") back into raw HTML characters. The decoded content is then output in the faq-answer.php template without WordPress sanitization functions like wp_kses_post(). The vulnerability combines two weaknesses: entity encoding creates a bypass for WordPress's kses content sanitization (which filters at save time and sees entities as literal text, not HTML tags), and insufficient output escaping allows decoded HTML to execute. The ufaq custom post type is registered with 'show_in_rest' => true and uses default 'post' capability_type, enabling Author-level REST API access. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), specifically a variant combining input bypass (entity encoding) with output encoding failure.

RemediationAI

Update Ultimate FAQ Accordion plugin to the patched version released after 2.4.7. Verify the fix in the plugin repository changelog at plugins.trac.wordpress.org/changeset to confirm that html_entity_decode() has been removed or that output escaping (wp_kses_post() or equivalent) has been added to faq-answer.php. As an interim workaround, restrict Author capability to create FAQ posts by using WordPress role management plugins or by modifying the 'post' capability_type in CustomPostTypes.class.php to require higher privileges (e.g., Editor). Disable REST API access to the ufaq custom post type if not required by disabling 'show_in_rest' in the plugin code. Audit existing FAQ content for entity-encoded payloads and remove suspicious entries.