What is the CVSS score of CVE-2026-4859?

CVE-2026-4859 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

SP Blog Designer CVE-2026-4859

EUVD-2026-29395 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-p424-c7qx-c8pc

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The SP Blog Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'design' attribute of the wpsbd_post_carousel shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

SP Blog Designer plugin for WordPress versions up to 1.0.0 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'design' attribute of the wpsbd_post_carousel shortcode, resulting in stored cross-site scripting (XSS) that executes for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in shortcode handling. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

SP Blog Designer is a WordPress plugin (CPE: cpe:2.3:a:softpulseinfotech:sp_blog_designer) that provides page-building and carousel functionality through WordPress shortcodes. The vulnerability exists in the wpsbd_post_carousel shortcode handler within the plugin's shortcode library. The 'design' attribute accepts user input without proper sanitization before storage in the WordPress post database, and fails to escape the output when the shortcode is rendered on the frontend. This is a classic stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where attacker-controlled data persists in the database and executes in the browsers of any user viewing the compromised post or page.

RemediationAI

Update SP Blog Designer to a patched version released after 1.0.0 if available from the plugin author or WordPress.org plugins repository. If no patched version is available, disable the plugin immediately and either remove it or request a security update from Softpulse Infotech. As a temporary compensating control, restrict Contributor-level access to only trusted users and implement a Web Application Firewall (WAF) rule to detect and block shortcode-based XSS patterns in POST requests to wp-admin endpoints (this limits damage but may block legitimate content updates). Site administrators should audit all existing posts and pages using the wpsbd_post_carousel shortcode for injected JavaScript in the 'design' attribute and sanitize any suspicious content. Consult Wordfence's vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/705b1da0-df92-40c2-a608-ccad32a9c224 for the most current patch information.