What is the CVSS score of CVE-2026-5508?

CVE-2026-5508 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5508

EUVD-2026-20123 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-x9gr-2hg2-49rr

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20123

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wowpress shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WowPress plugin for WordPress (all versions up to 1.0.0) allows authenticated attackers with contributor-level access and above to inject arbitrary JavaScript through insufficiently sanitized shortcode attributes, enabling malicious script execution in pages viewed by other users. CVSS 6.4 reflects moderate severity with network-accessible attack vector but requires authenticated access; no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from improper input sanitization and output escaping in the WowPress shortcode handler (CWE-79: Improper Neutralization of Input During Web Page Generation). The plugin accepts user-supplied attributes in the wowpress shortcode without adequate validation or escaping before rendering them in page output. WordPress shortcodes are processed server-side during page rendering and executed in the context of the WordPress editor and frontend, making them a high-value injection point. The CPE cpe:2.3:a:theyeti:wowpress:*:*:*:*:*:*:*:* indicates all versions of the WowPress plugin by TheYeti are affected. This is a classic stored XSS scenario where malicious payloads persist in the database (via page/post content) and execute whenever the page is accessed.

RemediationAI

Update the WowPress plugin to a patched version released by TheYeti after 1.0.0, if available. If no patched version is available, disable or remove the WowPress plugin entirely. For WordPress administrators unable to update immediately, audit all pages and posts using the [wowpress] shortcode for suspicious attribute content, review contributor account permissions to restrict XSS injection opportunities, and consider using a Web Application Firewall (WAF) rule to detect and block stored XSS payloads in shortcode attributes. Monitor the WordPress plugin repository and Wordfence threat intelligence for patched version availability at https://www.wordfence.com/threat-intel/vulnerabilities/id/893fa8c6-dcb4-4613-a836-8c717f859696.