What is the CVSS score of CVE-2026-6256?

CVE-2026-6256 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Credits Shortcode WordPress Plugin CVE-2026-6256

EUVD-2026-29403 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-rch9-7rqw-2x92

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Credits Shortcode WordPress plugin up to version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via the 'link' attribute of the credits shortcode, which executes when other users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes. CVSS 6.4 reflects moderate risk with network vector and limited scope impact, though real-world risk depends on site contributor population and user awareness.

Technical ContextAI

The Credits Shortcode plugin processes shortcode attributes without proper escaping before rendering them in HTML output. The vulnerable 'link' attribute (referenced in source at line 36 of credits_shortcode.php) is rendered directly into page content without sanitization or context-aware escaping functions. This is a classic Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) scenario where an authenticated user with contributor-level permissions can store malicious JavaScript in the WordPress database via a shortcode, and that payload executes in the browsers of all users (including administrators) who view the affected page. The attack persists in the database until the post is edited or deleted.

RemediationAI

Update the Credits Shortcode plugin to a patched version above 1.2 immediately. WordPress administrators should navigate to Plugins > Installed Plugins, locate Credits Shortcode, and click 'Update Now' if a newer version is available in the WordPress Plugin Directory. If no update is currently available, temporarily deactivate the plugin (Plugins > Installed Plugins > Deactivate) to prevent exploitation until a patch is released. For sites that require this plugin and cannot update, implement the following compensating controls: (1) restrict contributor role to trusted administrators only via WordPress user management, reducing the attack surface to accounts you fully control; (2) enable a Web Application Firewall (WAF) rule to detect and block script tags in POST requests containing shortcode parameters, though this may block legitimate use cases; (3) audit existing posts/pages for malicious shortcode usage using a code scanner or manual review of credits shortcodes in the WordPress dashboard. Note: these controls do not eliminate the vulnerability and should only be temporary measures while awaiting a permanent patch.