What is the CVSS score of CVE-2026-6397?

CVE-2026-6397 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress Sticky CVE-2026-6397

EUVD-2026-31017 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 Wordfence

GHSA-c2q9-qp4m-w7vm

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:35 vuln.today

DescriptionCVE.org

The Sticky plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cvmh-sticky shortcode readmoretext attribute in versions up to and including 2.5.6. This is due to insufficient input sanitization and output escaping in the cvmh_sticky_front_render() function - the readmoretext attribute value is passed through apply_filters() and directly concatenated into the HTML output without any escaping function such as esc_html(). This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a page containing the injected shortcode.

AnalysisAI

Stored Cross-Site Scripting in the CVMH Sticky plugin for WordPress (versions ≤2.5.6) enables authenticated contributors to inject persistent JavaScript via the readmoretext attribute of the [cvmh-sticky] shortcode. The payload executes in the browsers of any visitor loading a page containing the injected shortcode, enabling session hijacking, credential theft, or privilege escalation by targeting administrators. No public exploit is identified at time of analysis and this vulnerability is not listed in CISA KEV, but Wordfence has confirmed the flaw with direct code-level references.

Technical ContextAI

The CVMH Sticky plugin (CPE: cpe:2.3:a:cvmh:sticky:*:*:*:*:*:*:*:*) renders shortcodes via the cvmh_sticky_front_render() function defined in includes/functions.php (line 118), with shortcode registration in includes/shortcode.php (line 7). The root cause is CWE-79: the readmoretext attribute is passed through WordPress's apply_filters() hook - which allows third-party filter callbacks to modify the value - and then concatenated directly into the HTML output string without any output escaping function such as esc_html() or esc_attr(). This means attacker-controlled HTML/JavaScript survives both storage and rendering. The CVSS scope change (S:C) is significant here: the payload stored by a low-privilege contributor executes in site visitors' browser contexts, crossing security boundaries beyond the contributor's own session.

RemediationAI

The primary remediation is to update the Sticky plugin to a version beyond 2.5.6 once a patched release is confirmed available; monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/135783c5-8175-4775-a013-f1e2bef04479 for patch confirmation, as no specific fixed version is independently confirmed from current reference data. As an immediate compensating control, administrators should audit existing Contributor-level accounts and disable or remove unnecessary contributors, directly eliminating the required privilege level for exploitation. Disabling or deactivating the Sticky plugin entirely removes the attack surface with no residual risk beyond loss of the plugin's functionality. Deploying a WordPress-aware WAF such as Wordfence's own firewall rule engine can intercept known XSS payload patterns in shortcode attributes, though this is bypassable and should not substitute for patching. Restricting post/page creation permissions to trusted roles only (Editor and above) on sensitive or high-traffic sites is a targeted control with minimal operational impact.