What is the CVSS score of CVE-2026-5340?

CVE-2026-5340 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Fancy Image Show CVE-2026-5340

EUVD-2026-29398 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-2v9r-7h3f-vg95

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:46 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Fancy Image Show plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fancy-img-show shortcode in all versions up to, and including, 9.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Fancy Image Show plugin for WordPress up to version 9.1 allows authenticated contributors and above to inject arbitrary JavaScript via the fancy-img-show shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, affecting site integrity and potentially compromising administrative accounts. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The Fancy Image Show WordPress plugin processes user-supplied attributes in the fancy-img-show shortcode handler without proper sanitization before output. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where shortcode attributes are reflected into page HTML without HTML entity encoding or Content Security Policy safeguards. The affected code is in the shortcode handler at line 178 of the main plugin file, where user-controlled parameters are directly concatenated into JavaScript or HTML output. WordPress shortcodes, while intended to accept user input, require explicit escaping functions (such as wp_kses_post(), esc_attr(), or esc_js()) to prevent XSS when attributes originate from post content or user-editable fields. The plugin fails to apply these protections, allowing persistence of malicious payloads in post content accessible to all site visitors.

RemediationAI

The primary remediation is to upgrade Fancy Image Show to a patched version released by the plugin developer. Check the plugin update status in WordPress admin or on the official WordPress plugin repository (plugins.wordpress.org/fancy-image-show) for an available patch. If no patch is immediately available, disable the fancy-img-show shortcode by removing or deactivating the plugin until a fix is released. As a temporary workaround on sites requiring the plugin, restrict contributor-level access to only trusted users and audit existing posts containing the fancy-img-show shortcode for malicious injected code using the WordPress repository browser (plugins.trac.wordpress.org/browser/fancy-image-show/). Enable WordPress security headers including Content-Security-Policy (via security plugins like Wordfence or WP Security) to mitigate XSS impact by preventing inline script execution, though this may affect legitimate plugin functionality and requires testing.