What is the CVSS score of CVE-2026-7661?

CVE-2026-7661 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Bootstrap Shortcode CVE-2026-7661

EUVD-2026-29421 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-r99x-848h-xghh

XSS WordPress Bootstrap

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Bootstrap Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the box shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the Bootstrap Shortcode plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the box shortcode, executing malicious scripts whenever users view affected pages. The vulnerability exists in all versions up to 1.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at this time.

Technical ContextAI

The Bootstrap Shortcode plugin processes user-supplied attributes within the box shortcode without proper sanitization or escaping before rendering output to the DOM. This is a classic stored XSS vulnerability (CWE-79) where attacker-controlled input persists in WordPress post/page content and executes in the browser context of all users viewing that page. The vulnerability is rooted in WordPress's shortcode handler mechanism, which requires developers to explicitly sanitize input via functions like sanitize_text_field() or wp_kses_post() and escape output via esc_html(), esc_attr(), or wp_kses_post() before rendering. The lack of these protections allows JavaScript injection through shortcode attributes. The affected CPE (cpe:2.3:a:shamim_d:bootstrap_shortcode:*:*:*:*:*:*:*:*) indicates all versions of the plugin from this vendor are in scope.

RemediationAI

Update the Bootstrap Shortcode plugin to the patched version released by the vendor. No specific patched version number is confirmed from available data, but vendors typically release updates immediately upon disclosure; check the WordPress plugin repository and plugin settings dashboard for available updates. If no patched version is available from the vendor, temporarily disable the plugin entirely until a fix is released. As a temporary compensating control, restrict Contributor-level access to only trusted users by reviewing user roles in WordPress admin settings and downgrading unnecessary Contributor accounts to Subscriber role. Additionally, audit existing pages and posts for suspicious box shortcodes containing JavaScript or event handlers (look for patterns like onerror=, onclick=, or <script> tags within shortcode attributes). Apply Web Application Firewall (WAF) rules to detect and block stored XSS patterns in plugin shortcode parameters if available through your hosting provider. Note that these workarounds are incomplete and should not substitute for patching-stored XSS already injected will persist until the database is cleaned. For detailed remediation guidance, refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2df53b60-c524-4ebd-9a99-ef8e14c140c7?source=cve.