What is the CVSS score of CVE-2026-7509?

CVE-2026-7509 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

KIA Subtitle CVE-2026-7509

EUVD-2026-31406 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-22 Wordfence

GHSA-m4c4-9rgw-f76c

WordPress XSS Wordpress Plugin Kia Subtitle

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:17 vuln.today

DescriptionCVE.org

The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's the-subtitle shortcode before and after attributes in all versions up to, and including, 4.0.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the KIA Subtitle WordPress plugin (all versions through 4.0.1) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts via the before and after attributes of the the-subtitle shortcode. Any site visitor loading a page containing the injected shortcode will execute the attacker's script in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (Contributor) and network-accessible attack vector make this a meaningful risk for multi-author WordPress sites.

Technical ContextAI

The vulnerability resides in kia-subtitle.php (vendor: helgatheviking, CPE: cpe:2.3:a:helgatheviking:kia_subtitle:*:*:*:*:*:*:*:*), a WordPress plugin that renders post subtitles via the [the-subtitle] shortcode. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically insufficient sanitization of user-supplied before and after shortcode attributes prior to output. References point to vulnerable logic at lines L329 and L359 in kia-subtitle.php version 4.0.1; the corresponding patched file in version 4.0.2 shows changes at L369 and L370, consistent with added escaping calls. Because WordPress contributor accounts can insert shortcodes in post content by default, no elevated capability beyond Contributor role is needed to deliver the payload into published pages.

RemediationAI

The primary fix is to upgrade to KIA Subtitle version 4.0.2, which contains corrected output escaping in kia-subtitle.php. The patched source is confirmed in the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/kia-subtitle/tags/4.0.2/kia-subtitle.php. The Wordfence threat intelligence entry at https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a52097-0d85-4036-9b74-f35fea549607 provides additional advisory detail. As a compensating control pending upgrade, site administrators should audit and remove Contributor-level accounts that are not operationally required, since the attack requires at minimum Contributor access. Disabling the [the-subtitle] shortcode entirely via a capability-filtering plugin (e.g., restricting shortcode use to Editor-and-above roles) is an additional hardening measure, though it will prevent legitimate subtitle functionality for lower-privileged authors. A WAF rule blocking script-like patterns in shortcode attribute values can provide partial detection but is not a substitute for patching.