EUVD-2026-35309
GHSA-mpm9-9fmw-j56f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The ePaperFlip Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'publicationid' attribute of the epaperflip_embed shortcode in all versions up to, and including, 1. This is due to insufficient input sanitization and output escaping on the shortcode attribute which is injected directly into inline JavaScript. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the ePaperFlip Publisher WordPress plugin (all versions up to and including 1) permits authenticated Contributors to inject arbitrary JavaScript via the 'publicationid' attribute of the epaperflip_embed shortcode, which is written unsanitized directly into inline JavaScript on rendered pages. The CVSS Changed scope (S:C) reflects that the injected payload executes in the browser context of any visitor who loads the compromised page, crossing trust boundaries beyond the plugin itself. No public exploit code has been identified at time of analysis and this vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
The ePaperFlip Publisher plugin (vendor: joshin85, CPE: cpe:2.3:a:joshin85:plugin_name:_epaperflip_publisher:*:*:*:*:*:*:*:*) registers a WordPress shortcode epaperflip_embed that accepts a 'publicationid' parameter. Per the source code referenced at plugins.trac.wordpress.org (line 28 of ePaperFlip Publisher.php), this attribute is concatenated directly into inline JavaScript without sanitization or escaping - a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) pattern. WordPress shortcode attributes are user-controlled strings; the failure to apply wp_kses, esc_js, or equivalent escaping functions before embedding the value in a script context is the root cause. The Changed scope in the CVSS vector is consistent with XSS behavior: the vulnerable component (the plugin/page renderer) grants an attacker influence over the browser's JavaScript execution environment, which operates under a different security principal than the WordPress application itself.
RemediationAI
No vendor-released patched version has been confirmed at time of analysis - the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/93be1150-4c83-4fa3-8dc6-71e2f1ddaa66 should be monitored for patch availability. Until a fix is released, site administrators should deactivate and remove the ePaperFlip Publisher plugin entirely, as this eliminates the attack surface with no functional trade-off beyond losing the epaperflip_embed shortcode capability. As a compensating control where the plugin must remain active, restrict the Contributor role's ability to publish posts without editorial review, ensuring that shortcode-bearing content is reviewed by a trusted Editor or Administrator before going live - this prevents unapproved payloads from reaching visitors. Additionally, consider deploying a Web Application Firewall (such as Wordfence's own firewall rules) that can detect and block shortcode-based XSS injection patterns at the request layer. Note that role-restricting plugins may interfere with existing contributor workflows.
More in Plugin Name
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today