What is the CVSS score of CVE-2026-5717?

CVE-2026-5717 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5717

EUVD-2026-22847 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Wordfence

GHSA-wwww-f4wq-25hx

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 08:36 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 08:30 euvd

EUVD-2026-22847

Analysis Generated

Apr 15, 2026 - 08:30 vuln.today

CVE Published

Apr 15, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attribute of the 'include-post-by-cat' shortcode in all versions up to, and including, 0.4.200706 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in VI: Include Post By WordPress plugin up to version 0.4.200706 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class_container' shortcode attribute, which executes in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode parameters. No public exploit code or active exploitation has been reported; however, the low attack complexity and broad scope of impact (affecting all site visitors) make this a moderate-priority issue for WordPress installations using this plugin.

Technical ContextAI

The VI: Include Post By plugin processes the 'include-post-by-cat' shortcode and accepts user-supplied attributes including 'class_container' without proper sanitization or escaping. The shortcode handler directly interpolates these attributes into HTML output, violating the principle of contextual output encoding. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where an authenticated user with contributor privileges can craft malicious shortcodes containing JavaScript payloads. These payloads are persisted in the WordPress database and executed in the DOM context of every page visitor, bypassing client-side protections and affecting site-wide security posture.

RemediationAI

Update the VI: Include Post By plugin to the latest version available on WordPress.org immediately; if a patched version beyond 0.4.200706 has been released, upgrade to it. If no newer version is available, disable and deactivate the plugin until a security update is released, then conduct a post-incident security audit of all pages and posts created or modified by contributors during the plugin's active period to identify and remove any injected scripts. Restrict contributor-level access to trusted users only and implement code review workflows for shortcode usage. Monitor the plugin's repository page at https://plugins.trac.wordpress.org/browser/vi-include-post-by/trunk/ for security patches and follow Wordfence security advisories for further guidance.