What is the CVSS score of CVE-2026-7662?

CVE-2026-7662 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ePaperFlip Publisher CVE-2026-7662

EUVD-2026-35309 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-mpm9-9fmw-j56f

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:19 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attribute of the epaperflip_embed shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on the shortcode attribute which is injected directly into inline JavaScript. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the ePaperFlip Publisher WordPress plugin (all versions up to and including 1) permits authenticated Contributors to inject arbitrary JavaScript via the 'publicationid' attribute of the epaperflip_embed shortcode, which is written unsanitized directly into inline JavaScript on rendered pages. The CVSS Changed scope (S:C) reflects that the injected payload executes in the browser context of any visitor who loads the compromised page, crossing trust boundaries beyond the plugin itself. No public exploit code has been identified at time of analysis and this vulnerability is not currently listed in the CISA KEV catalog.

Technical ContextAI

The ePaperFlip Publisher plugin (vendor: joshin85, CPE: cpe:2.3:a:joshin85:plugin_name:_epaperflip_publisher:*:*:*:*:*:*:*:*) registers a WordPress shortcode epaperflip_embed that accepts a 'publicationid' parameter. Per the source code referenced at plugins.trac.wordpress.org (line 28 of ePaperFlip Publisher.php), this attribute is concatenated directly into inline JavaScript without sanitization or escaping - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern. WordPress shortcode attributes are user-controlled strings; the failure to apply wp_kses, esc_js, or equivalent escaping functions before embedding the value in a script context is the root cause. The Changed scope in the CVSS vector is consistent with XSS behavior: the vulnerable component (the plugin/page renderer) grants an attacker influence over the browser's JavaScript execution environment, which operates under a different security principal than the WordPress application itself.

RemediationAI

No vendor-released patched version has been confirmed at time of analysis - the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/93be1150-4c83-4fa3-8dc6-71e2f1ddaa66 should be monitored for patch availability. Until a fix is released, site administrators should deactivate and remove the ePaperFlip Publisher plugin entirely, as this eliminates the attack surface with no functional trade-off beyond losing the epaperflip_embed shortcode capability. As a compensating control where the plugin must remain active, restrict the Contributor role's ability to publish posts without editorial review, ensuring that shortcode-bearing content is reviewed by a trusted Editor or Administrator before going live - this prevents unapproved payloads from reaching visitors. Additionally, consider deploying a Web Application Firewall (such as Wordfence's own firewall rules) that can detect and block shortcode-based XSS injection patterns at the request layer. Note that role-restricting plugins may interfere with existing contributor workflows.