What is the CVSS score of CVE-2026-6704?

CVE-2026-6704 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Blog Settings WordPress Plugin CVE-2026-6704

EUVD-2026-27209 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-g4p8-grmx-3hm2

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The Blog Settings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in Blog Settings plugin for WordPress versions up to 1.0 allows unauthenticated attackers to inject arbitrary JavaScript via the 'page' parameter due to insufficient input sanitization and output escaping. An attacker must trick a user into clicking a malicious link to execute the injected script in the victim's browser session, potentially compromising WordPress admin credentials or site functionality.

Technical ContextAI

The Blog Settings plugin processes the 'page' parameter without proper input sanitization or output escaping before rendering it in HTML responses. This is a classic Reflected XSS vulnerability (CWE-79) where user-supplied input flows directly into the DOM without sanitization. The vulnerability exists in the plugin's handling of query parameters, likely in the admin settings page or public-facing template processing. WordPress itself provides sanitization functions (sanitize_text_field, wp_kses_post) and escaping functions (esc_attr, esc_html, esc_js) that the plugin developer failed to apply to the 'page' parameter before output. Code references point to blog-settings.php lines 46 and 173, suggesting the vulnerability spans initialization and template rendering stages.

RemediationAI

Update the Blog Settings plugin to the latest patched version released after version 1.0, or disable and remove the plugin if it is not in active use. The vulnerability was disclosed by Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/d28e5374-dd34-4745-a20b-059e9846d96d), and the plugin developer should have released a corrected version addressing input sanitization and output escaping of the 'page' parameter. If a patched version is unavailable, apply WordPress security hardening: restrict plugin access to admin users only via conditional loading in wp-config.php, disable the plugin via wp-cli (wp plugin deactivate blog-settings), or implement a Web Application Firewall rule to block requests with suspicious 'page' parameter values (though this is a temporary measure only). Monitor the WordPress plugin repository for security updates or consider switching to an alternative blog settings plugin with active maintenance.