What is the CVSS score of CVE-2026-6255?

CVE-2026-6255 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Simple Owl Shortcodes CVE-2026-6255

EUVD-2026-27199 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-qpmj-rjxh-7h62

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The Simple Owl Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'num' attribute of the 'owls_wrapper' shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Simple Owl Shortcodes WordPress plugin versions up to 2.1.1 allows authenticated contributors and above to inject arbitrary JavaScript via the 'num' attribute of the 'owls_wrapper' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

Simple Owl Shortcodes is a WordPress plugin that extends the platform's shortcode functionality to render custom content blocks. The vulnerability resides in the 'owls_wrapper' shortcode handler (located in inc/owls_wrapper.php), which accepts user-supplied attributes including a 'num' parameter. The plugin fails to properly sanitize this attribute before outputting it to the page, violating the WordPress security principle of escaping data on output. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a class of injection vulnerabilities where untrusted input is rendered directly into HTML/JavaScript context without sanitization or encoding. Because the vulnerability allows stored (persistent) injection via shortcode attributes embedded in post/page content, any authenticated user viewing the page thereafter will execute the attacker's script.

RemediationAI

Update Simple Owl Shortcodes to the latest patched version available from the WordPress plugin repository immediately. At the time of this analysis, the specific fixed version number is not confirmed in the provided data - check the WordPress plugin directory or Wordfence advisory for the exact version addressing CVE-2026-6255. If a patch is available, the remediation is straightforward: navigate to Plugins → Installed Plugins in WordPress admin, locate Simple Owl Shortcodes, and click 'Update Now'. For sites unable to update immediately, implement the following compensating control: restrict contributor-level access to only trusted administrators by managing user roles in WordPress Users panel, reducing the attack surface to a smaller trusted group. A second mitigation (with trade-offs) is to deactivate the Simple Owl Shortcodes plugin entirely if not actively used; this prevents shortcode execution entirely but removes plugin functionality. Monitor Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/e33a2f27-20c2-4963-9558-1eead0515690) and the official WordPress plugin repository for patch release announcements.