What is the CVSS score of CVE-2026-4389?

CVE-2026-4389 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4389?

Organizations using all should be aware of moderate risk from CVE-2026-4389, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2026-4389?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-4389

EUVD-2026-16106 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 Wordfence

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 05:15 euvd

EUVD-2026-16106

Analysis Generated

Mar 26, 2026 - 05:15 vuln.today

CVE Published

Mar 26, 2026 - 04:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the leafext-cookie-time and leafext-delete-cookie shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (unset, before, after). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

This is a Stored Cross-Site Scripting (XSS) vulnerability in the DSGVO Snippet for Leaflet Map and its Extensions WordPress plugin (all versions up to and including 3.1) that allows authenticated attackers with contributor-level or higher privileges to inject arbitrary JavaScript code into pages via the leafext-cookie-time and leafext-delete-cookie shortcodes. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes (unset, before, after), enabling script execution whenever visitors access the compromised pages. With a CVSS score of 6.4 and attack complexity of low, this represents a moderate but real threat in WordPress environments where multiple content contributors exist.

Technical ContextAI

The vulnerability exists in the WordPress plugin codebase as identified through CPE string cpe:2.3:a:hupe13:dsgvo_snippet_for_leaflet_map_and_its_extensions, specifically within the shortcode handler implementations in php/time-delete.php (line 35 and surrounding code as evidenced by the WordPress plugin repository references). The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting). The plugin processes shortcode attributes without proper sanitization before database storage (leading to Stored XSS rather than Reflected XSS) and fails to escape output when rendering these attributes back to the front-end. This is a classic input-validation and output-encoding gap in WordPress plugin development where shortcode callbacks must both sanitize inputs at registration time and escape outputs at render time.

RemediationAI

Immediately upgrade the DSGVO Snippet for Leaflet Map and its Extensions plugin to version 3.2 or later, which contains patches for the shortcode attribute sanitization and escaping issues. The patch changeset is available in the WordPress plugin repository trunk and can be reviewed at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489426%40dsgvo-leaflet-map%2Ftrunk&old=3488424%40dsgvo-leaflet-map%2Ftrunk. As an interim mitigation before patching, administrators should restrict contributor-level access to only trusted users, audit existing pages and posts for suspicious content in the leafext-cookie-time and leafext-delete-cookie shortcodes, and consider disabling these shortcodes if not actively used. Additionally, implement WordPress security hardening practices such as limiting plugin updates to administrators and enabling security monitoring via Wordfence or equivalent solutions.