What is the CVSS score of CVE-2026-4871?

CVE-2026-4871 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4871

EUVD-2026-20115 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-xw32-79fh-wwgf

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20115

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The Sports Club Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before' and 'after' attributes of the scm_member_data shortcode in all versions up to, and including, 1.12.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Sports Club Management WordPress plugin versions up to 1.12.9 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into shortcode attributes, which executes when other users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the scm_member_data shortcode's 'before' and 'after' parameters, requiring only basic WordPress login privileges but affecting all site visitors who access injected content. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

The Sports Club Management plugin (CPE: cpe:2.3:a:pstruik:sports_club_management:*:*:*:*:*:*:*:*) processes the scm_member_data shortcode with 'before' and 'after' attributes that are output directly to page content without proper escaping. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS vulnerability where user-controlled input from shortcode parameters flows into the HTML output without sanitization on input or escaping on output. The vulnerability exists in the members_shortcodes.php file (line 129 and surrounding context) where attribute values are rendered to the DOM without using WordPress escaping functions like esc_attr() or wp_kses_post().

RemediationAI

Update the Sports Club Management plugin to a version released after 1.12.9 that includes patches for input sanitization and output escaping in the scm_member_data shortcode's 'before' and 'after' attributes. Consult the plugin's official release history or the WordPress plugin repository (https://plugins.trac.wordpress.org/) for the patched version number. As an interim workaround, restrict Contributor-level role permissions to prevent untrusted users from creating or editing posts/pages with shortcodes, or disable the scm_member_data shortcode entirely if not actively used. Review existing published pages for any suspicious shortcode usage and remove injected scripts before updating.