What is the CVSS score of CVE-2026-4811?

CVE-2026-4811 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WPB Floating Menu CVE-2026-4811

EUVD-2026-31208 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-21 Wordfence

GHSA-3q6m-7jw2-r5m4

WordPress XSS

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 21, 2026 - 03:43 vuln.today

DescriptionCVE.org

The WPB Floating Menu & Categories for WordPress - Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Class' category field in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the WPB Floating Menu & Categories WordPress plugin (all versions through 1.0.8) permits authenticated attackers holding Editor-level privileges or higher to inject arbitrary JavaScript via the 'Icon CSS Class' category field. The injected payload persists in the database and executes in the browser of any site visitor who loads a page containing the affected floating menu component, enabling session hijacking or credential harvesting against arbitrary users including administrators. No public exploit has been identified at time of analysis, and the plugin is not listed in the CISA KEV catalog; the CVSS 4.9 Medium score reflects the significant mitigation provided by the high-privilege prerequisite.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause class: user-controlled data is stored without adequate sanitization and later rendered in HTML context without proper output escaping. The Wordfence Trac reference pinpoints the flaw to admin/category-icon.php at line 41, where the 'Icon CSS Class' field value is written to the DOM without encoding. The affected product per CPE is cpe:2.3:a:wpbean:wpb_floating_menu_or_categories_-_sticky_floating_side_menu_&_categories_with_icons covering all versions through 1.0.8. This is a classic second-order (stored) XSS pattern: the injection point is the WordPress admin panel, but the execution context is the front-end page rendered for every site visitor, making victim scope broader than the privilege level of the attacker.

RemediationAI

Update the plugin beyond version 1.0.8 by checking the WordPress.org plugin repository (wordpress.org/plugins/wpb-floating-menu-or-categories) for a release that addresses this issue - no specific patched version number is confirmed in the available data; monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/961702ff-60fb-41ff-99b0-a37ade051083 for patch confirmation. As a compensating control while awaiting a fix, restrict the WordPress Editor role to fully trusted users only, since exploitation is gated on Editor-level access; this does not eliminate the vulnerability but removes the attacker's required foothold. If untrusted editors must be accommodated, consider temporarily deactivating the plugin - this prevents payload delivery to front-end visitors but removes floating menu functionality site-wide. Do not rely on network-layer controls alone, as the injection point is within the authenticated admin interface and the execution context is the public front end.