What is the CVSS score of CVE-2026-5748?

CVE-2026-5748 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Text Snippets plugin CVE-2026-5748

EUVD-2026-24692 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24692

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Text Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ts shortcode in all versions up to, and including, 0.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting (XSS) in the Text Snippets plugin for WordPress up to version 0.0.1 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via unsanitized shortcode attributes, which executes whenever any user visits the affected page. The vulnerability stems from insufficient input sanitization and output escaping on the ts shortcode, enabling persistent payload injection. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Text Snippets plugin for WordPress implements a ts shortcode that accepts user-supplied attributes without proper sanitization or escaping. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a foundational XSS class. The shortcode processes and outputs attribute data directly into the page HTML context without converting special characters (e.g., converting < to <) or validating input structure. WordPress's native escaping functions (such as esc_attr() or wp_kses_post()) appear not to have been applied to the shortcode attribute output. CPE cpe:2.3:a:snedled:text_snippets:*:*:*:*:*:*:*:* identifies all versions of the plugin as affected through version 0.0.1.

RemediationAI

Update the Text Snippets plugin to a patched version immediately if available from the plugin author via the WordPress plugin repository. If no patch has been released, disable the plugin entirely via the WordPress admin panel (Plugins > Installed Plugins > Deactivate). As a temporary compensating control pending patch availability, WordPress administrators can restrict contributor-level access to only trusted, verified users by reviewing and modifying user roles under Users > All Users in the WordPress admin; however, this reduces site functionality for legitimate contributors. Alternatively, if the ts shortcode is not actively used on the site, remove all instances of [ts ...] from page and post content, or block the shortcode registration via a code snippet in functions.php: remove_shortcode( 'ts' );. Check the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/8cc7a0f3-6a58-4e42-9341-aecf55d2ccb1) for patch availability updates and the WordPress plugin repository for updated versions.