What is the CVSS score of CVE-2026-6174?

CVE-2026-6174 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

CC Child Pages WordPress Plugin CVE-2026-6174

EUVD-2026-30259 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-14 security@wordfence.com

GHSA-94q8-hmf4-cc43

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 09:30 vuln.today

CVE Published

May 14, 2026 - 09:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in CC Child Pages WordPress plugin up to version 2.1.1 allows authenticated attackers with Contributor-level access and above to inject arbitrary JavaScript via the 'more' parameter, which executes in the browsers of users viewing the compromised pages. CVSS 6.4 reflects the authentication gate but cross-site scope (C:L/I:L/S:C). No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The plugin fails to properly sanitize user input to the 'more' parameter and does not adequately escape output when rendering pages containing this parameter. The vulnerability is a classic Stored XSS (CWE-79: Cross-site Scripting) executed through the plugin's page rendering mechanism. Input submitted by authenticated Contributor-level users persists in the WordPress database and is rendered unsanitized in the frontend HTML, allowing JavaScript payload injection. The 'more' parameter likely controls user-facing text or markup in the child pages display functionality, making it a natural attack surface for XSS.

RemediationAI

Update CC Child Pages plugin to version 2.1.2 or later immediately through the WordPress admin dashboard (Plugins → Installed Plugins → CC Child Pages → Update). WordPress administrators should verify the update applies patch changeset 3513934 from the plugin repository, which addresses input sanitization and output escaping of the 'more' parameter. For sites unable to update immediately, restrict Contributor-level user access to pages with the CC Child Pages plugin active, or disable the plugin entirely until patched. Administrators should audit existing pages for malicious script injections and remove any suspicious content in the 'more' parameter field. Install a WordPress security plugin (e.g., Wordfence, Sucuri) to monitor for stored XSS payloads and detect exploitation attempts.