What is the CVSS score of CVE-2026-6236?

CVE-2026-6236 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Posts Map for WordPress CVE-2026-6236

EUVD-2026-24702 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-ppmh-rcj7-3qgj

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:03 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24702

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Posts map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute in all versions up to, and including, 0.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Posts Map plugin for WordPress up to version 0.1.3 allows authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. When any user accesses a page containing the malicious shortcode, the injected script executes in their browser with the privileges of their WordPress session, potentially enabling account compromise, admin impersonation, or malware distribution. The vulnerability requires contributor-level or higher access and affects all versions through 0.1.3.

Technical ContextAI

Posts Map is a WordPress plugin that renders interactive maps with custom post data using shortcode attributes. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) - specifically, the 'name' attribute of the Posts Map shortcode is passed directly to HTML output without proper sanitization during input processing or escaping during output rendering. WordPress shortcode handlers typically receive user-supplied parameters, which must be sanitized (cleaned of dangerous input) via functions like sanitize_text_field() and escaped for output context via esc_attr() for HTML attributes or esc_html() for text content. The plugin's code at lines 33 and 78 of posts-map.php shows the vulnerable shortcode handling and rendering logic. The CPE cpe:2.3:a:lucdecri:posts_map:*:*:*:*:*:*:*:* indicates this affects all versions of the plugin authored by lucdecri.

RemediationAI

Update Posts Map plugin to version 0.1.4 or later immediately - this patched version will be released following responsible disclosure (check the WordPress plugin repository for the latest available version). Until a patch is released or available, implement the following compensating controls: (1) Restrict contributor-level access to post/page creation to only fully-trusted users - disable contributor publishing privileges if possible and require editor+ review before content goes live (this limits attack surface but may impact workflow); (2) use WordPress security plugins like Wordfence, Sucuri, or iThemes Security to enable Content Security Policy (CSP) headers, which block inline script execution even if XSS is injected (requires CSP header configuration and may break some legitimate plugins); (3) disable or deactivate Posts Map plugin entirely until a patch is confirmed available (most effective mitigation but removes plugin functionality); (4) audit recent pages/posts for malicious shortcodes using the plugin repository browser link https://plugins.trac.wordpress.org/browser/posts-map/tags/0.1.3/posts-map.php to understand the vulnerable code pattern. Wordfence provides additional mitigation guidance at https://www.wordfence.com/threat-intel/vulnerabilities/id/e02c5817-7a54-4958-a076-71e5e7729cda?source=cve.