What is the CVSS score of CVE-2026-6246?

CVE-2026-6246 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Simple Random Posts Shortcode CVE-2026-6246

EUVD-2026-24704 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:02 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24704

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The Simple Random Posts Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'container_right_width' attribute of the 'simple_random_posts' shortcode in all versions up to, and including, 0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Simple Random Posts Shortcode plugin for WordPress versions up to 0.3 contains stored cross-site scripting (XSS) via insufficient sanitization of the 'container_right_width' shortcode attribute, allowing authenticated contributors and above to inject arbitrary JavaScript that executes in browsers of all users accessing affected pages. No active exploitation has been confirmed, but the vulnerability requires only contributor-level access and carries network-based attack vector with low complexity.

Technical ContextAI

The vulnerability exists in the WordPress plugin's shortcode handler, which processes user-supplied attributes without adequate input sanitization or output escaping. Specifically, the 'container_right_width' attribute of the 'simple_random_posts' shortcode is echoed directly into the page HTML without proper sanitization functions (such as sanitize_text_field() or similar WordPress-native sanitization) or escaping functions (such as esc_attr() when used in HTML attributes). This is a classic stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) where malicious input is persisted in the WordPress database as part of post/page content via shortcode attributes and later rendered without sanitization when the page is accessed. The attack vector is network-based because the shortcode can be embedded in any published post or page, making it accessible to remote users without direct system access.

RemediationAI

Update the Simple Random Posts Shortcode plugin to a version later than 0.3 if available; consult the plugin repository or vendor website for the latest patched release. If no patched version is available, immediately disable the plugin and remove or replace it with an actively maintained alternative. For sites unable to update immediately, restrict contributor-level access to trusted users only by reviewing WordPress user roles and capabilities (Settings > Users), and audit all existing posts and pages for 'simple_random_posts' shortcodes to identify and remove any that contain suspicious attribute values. Implement WordPress security hardening: enable code review workflows before post publishing, use security plugins (e.g., Wordfence) to detect and block malicious scripts, and apply Web Application Firewall (WAF) rules to block common XSS payloads in shortcode attributes. Review database backups to check for already-injected shortcodes. These compensating controls are not perfect substitutes for patching and should be combined with an update or plugin replacement plan.