What is the CVSS score of CVE-2026-8038?

CVE-2026-8038 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Faces of Users CVE-2026-8038

EUVD-2026-31043 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 Wordfence

GHSA-8q55-687m-f56c

WordPress XSS Wordpress Plugin Faces Of Users

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:38 vuln.today

DescriptionCVE.org

The Faces of Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in the 'facesofusers' shortcode in all versions up to, and including, 0.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Faces of Users WordPress plugin (all versions through 0.0.3) allows authenticated attackers with Contributor-level access or above to inject persistent malicious JavaScript via the 'default' attribute of the 'facesofusers' shortcode. Once injected, the payload executes silently in the browser of any user who visits the compromised page, enabling session theft, credential harvesting, or malicious redirects targeting higher-privileged users including administrators. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored variant. The affected component is the 'facesofusers' WordPress shortcode handler, where the 'default' attribute value is accepted from authenticated users but passed to output without adequate sanitization or escaping. The vulnerable logic is traceable to line 62 of faces-of.php in the plugin source (visible at plugins.trac.wordpress.org/browser/faces-of-users/tags/0.0.3/faces-of.php#L62). The affected product is identified by CPE cpe:2.3:a:mcinvale:faces_of_users:*:*:*:*:*:*:*:*, covering all published versions. The Changed scope (S:C) in the CVSS vector reflects the standard XSS characteristic where exploitation crosses from the web application context into victims' browser sessions.

RemediationAI

No vendor-released patch has been identified at time of analysis - the only published version in the WordPress plugin repository is 0.0.3, which is confirmed vulnerable. Site administrators should immediately deactivate and remove the Faces of Users plugin until a patched version is released. As a compensating control, restrict the ability of Contributor-level users to publish posts containing arbitrary shortcodes, using a plugin such as Prevent Block Access or a custom capability filter - note this may impact other plugin functionality. Additionally, audit existing published content for malicious injections via the 'facesofusers' shortcode, particularly in posts authored by contributors. Monitor the Wordfence advisory page at https://www.wordfence.com/threat-intel/vulnerabilities/id/ea39d249-0345-4028-af58-31b298376950 and the WordPress plugin repository for a patched release. If contributor registration is open to the public, temporarily disabling new registrations reduces the attack surface until a fix is available.