What is the CVSS score of CVE-2026-6913?

CVE-2026-6913 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Shortcodely WordPress Plugin CVE-2026-6913

EUVD-2026-29411 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-xpgw-5mhq-99jf

WordPress XSS Wordpress Plugin Shortcodely

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:45 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Shortcodely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'widget_area' parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Shortcodely WordPress plugin versions up to 1.0.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'widget_area' parameter, with scripts executing whenever users access affected pages. The vulnerability stems from insufficient input sanitization and output escaping, affecting all installations with vulnerable plugin versions active. CVSS 6.4 reflects the cross-site scope and information disclosure potential, though exploitation requires authenticated contributor-level access.

Technical ContextAI

Shortcodely is a WordPress plugin that processes shortcodes and widget area parameters. The vulnerability exists at the application layer where the 'widget_area' parameter is directly output to pages without proper sanitization or escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the plugin fails to neutralize user-controllable input before rendering HTML. The vulnerable code path spans multiple files in the plugin (lines 73, 92, and 118 in shortcodely.php based on the references), suggesting a pattern of unsafe parameter handling across the shortcode rendering logic. CPE identifier cpe:2.3:a:patilswapnilv:shortcodely:*:*:*:*:*:*:*:* confirms all versions of the Patilswapnilv-authored plugin are potentially affected through version 1.0.1.

RemediationAI

Update the Shortcodely plugin to a patched version released after 1.0.1 if available from the plugin author Patilswapnilv via the WordPress plugin repository. If a patched version is not yet available, disable the Shortcodely plugin entirely until an update is released. As a temporary compensating control on unpatched installations, restrict WordPress contributor role assignments to only trusted staff members, and audit existing contributors to remove any accounts no longer requiring that privilege level. Monitor pages that may have previously contained injected shortcodes for suspicious JavaScript content and remove any malicious code. Contact the plugin author through the WordPress plugin support channel to request a security update, or consider switching to an alternative shortcode plugin with demonstrated security practices if the Shortcodely maintainer does not release a timely patch.