What is the CVSS score of CVE-2026-6439?

CVE-2026-6439 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-6439

EUVD-2026-23399 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-17 Wordfence

GHSA-gc8m-6q8j-fh75

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 09:15 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 09:00 euvd

EUVD-2026-23399

Analysis Generated

Apr 17, 2026 - 09:00 vuln.today

CVE Published

Apr 17, 2026 - 08:28 nvd

MEDIUM 4.4

DescriptionCVE.org

The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The 'lang' POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a <textarea> element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.

AnalysisAI

Stored Cross-Site Scripting in VideoZen WordPress plugin versions up to 1.0.1 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes for all users accessing the settings page. The 'lang' POST parameter in the videozen_conf() function is stored without sanitization and output without escaping, enabling privilege-abusing admins to compromise any WordPress installation running the vulnerable plugin. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

VideoZen is a WordPress plugin (CPE: cpe:2.3:a:jconti:videozen:*:*:*:*:*:*:*:*) that handles video embedding and configuration. The vulnerability resides in the videozen_conf.php file at lines 24 and 69, where user-supplied POST data from the 'lang' parameter is passed directly to WordPress's update_option() function without input sanitization (line 24), then retrieved and echoed into a textarea HTML element without output escaping (line 69). The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) occurs because the plugin fails to apply standard WordPress escaping functions like sanitize_text_field() on input and esc_textarea() on output. This is a classic stored XSS vulnerability where malicious data persists in the WordPress options table and executes each time the settings page loads.

RemediationAI

Update VideoZen to the latest patched version available from the WordPress plugin repository. The fix requires sanitizing the 'lang' POST parameter using sanitize_text_field() or similar before passing to update_option() (line 24), and escaping the stored value with esc_textarea() when outputting to the HTML textarea element (line 69). If an immediate update is unavailable, restrict WordPress Administrator role to trusted users only and monitor the wp_options table for unexpected 'videozen_*' entries containing script tags or suspicious JavaScript code. Disable the VideoZen plugin entirely until patched if high-risk admin accounts (shared logins, service accounts) exist. Note: disabling the plugin may break video functionality on dependent pages, requiring alternative video embedding solutions.