What is the CVSS score of CVE-2026-6672?

CVE-2026-6672 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

SliceWP Affiliates CVE-2026-6672

EUVD-2026-27538 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-06 Wordfence

GHSA-2h5w-9g5w-vwph

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 07:45 vuln.today

DescriptionCVE.org

The Affiliate Program Suite - SliceWP Affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 1.2.7. This is due to insufficient input sanitization and output escaping on user-supplied attributes in the 'slicewp_affiliate_url' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in SliceWP Affiliates plugin for WordPress (versions up to 1.2.7) allows authenticated contributors and above to inject arbitrary JavaScript via unsanitized shortcode attributes in the 'slicewp_affiliate_url' shortcode. The injected scripts execute in the browsers of all users accessing the affected page, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified, but the vulnerability is straightforward to exploit given the low attack complexity and requires only contributor-level WordPress access.

Technical ContextAI

The vulnerability stems from insufficient input sanitization and output escaping in the 'slicewp_affiliate_url' shortcode handler within the SliceWP Affiliates plugin (CPE: cpe:2.3:a:iovamihai:affiliate_program_suite_-_slicewp_affiliates). WordPress shortcodes accept user-supplied attributes that are processed server-side and rendered into page output. When a shortcode does not properly sanitize input attributes before storing them in the database or escape them before output in HTML context, an attacker can embed JavaScript payloads that will execute in victim browsers. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation). The attack vector is network-based because the malicious content is stored and later retrieved and rendered by the web application, affecting any user who views the compromised page.

RemediationAI

Update SliceWP Affiliates plugin to version 1.2.8 or later immediately; this version includes patched input sanitization and output escaping for the 'slicewp_affiliate_url' shortcode. Vendors should implement proper use of WordPress sanitization functions (e.g., sanitize_text_field(), wp_kses_post()) at input time and escaping functions (e.g., esc_attr(), esc_html()) at output time for all shortcode attributes. As an interim workaround before patching, WordPress administrators can restrict contributor-level access to users who have demonstrable need and undergo security training, though this does not eliminate the vulnerability if those accounts are compromised. Alternatively, disable the SliceWP Affiliates plugin entirely if the affiliate functionality is not critical, then re-enable after patching. Review all pages and posts containing the 'slicewp_affiliate_url' shortcode for any suspicious attribute values that may have been injected before the patch was applied; use WordPress post revisions to identify when malicious content was inserted and audit user access logs for that period.