EUVD-2026-28541
GHSA-7929-xh7v-8jrh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's strava_nmr_connect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting (XSS) in the NMR Strava Activities WordPress plugin through version 1.0.14 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the strava_nmr_connect shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, compromising session security and enabling account takeover or malware distribution. A vendor patch addressing the vulnerability is available in version 1.0.15.
Technical ContextAI
The vulnerability exists in the shortcode handler for strava_nmr_connect within the NMR Strava Activities plugin (CPE: cpe:2.3:a:mirceatm:nmr_strava_activities:*:*:*:*:*:*:*:*), which integrates Strava fitness tracking data into WordPress sites. The underlying issue is a failure to properly sanitize and escape user-supplied shortcode attributes before rendering them in HTML output. This is a classic example of CWE-79 (Improper Neutralization of Input During Web Page Generation), where an attacker controls input that flows directly into the DOM without validation or encoding. The WordPress shortcode API accepts arbitrary attribute key-value pairs; the plugin parses these attributes but does not apply WordPress sanitization functions (sanitize_text_field, wp_kses_post) during input processing or escaping functions (esc_attr, esc_html, wp_kses_post) during output. By embedding script tags or event handlers in shortcode attributes, an attacker can break out of the intended context and execute JavaScript in victim browsers.
RemediationAI
Update the NMR Strava Activities plugin to version 1.0.15 or later immediately. WordPress administrators should navigate to Plugins → Installed Plugins, locate 'NMR Strava Activities', and click 'Update Now' if available, or manually download version 1.0.15 from the WordPress Plugin Repository and upload it via SFTP or the WordPress admin interface. No workarounds are recommended prior to patching, as this is a stored XSS flaw affecting all site visitors; attempting to sanitize existing malicious shortcode content via database queries is error-prone without understanding the exact injection vectors. As an interim compensating control only if immediate patching is not possible, restrict the 'Contributor' role via the User Role Editor plugin or by disabling user registration temporarily, but this is not a substitute for patching. After upgrading, verify that the shortcode attribute handling in nmr-strava-activities.php lines 240-251 (in version 1.0.15) includes proper escaping functions such as esc_attr() or wp_kses_post(). Scan the site's database for existing malicious shortcode instances using tools like Wordfence or manually querying wp_posts for suspicious [strava_nmr_connect patterns with script tags or event handlers.
More in Nmr Strava Activities
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today