What is the CVSS score of CVE-2026-8040?

CVE-2026-8040 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

faq shortcode CVE-2026-8040

EUVD-2026-32092 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-xxv4-8678-c28f

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:35 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the faq shortcode WordPress plugin (all versions up to and including 1.0) permits authenticated contributors to persist arbitrary JavaScript into site pages via the unsanitized 'color' attribute of the [faq] shortcode, with the payload executing in any visitor's browser upon page load. The vulnerability stems from missing input sanitization and output escaping in faq.php at line 65, and the changed scope (S:C in CVSS) confirms cross-user impact beyond the attacker's own session. No public exploit has been identified and EPSS sits at 0.03% (9th percentile), reflecting low current exploitation activity.

Technical ContextAI

The faq shortcode WordPress plugin processes user-supplied shortcode attributes and renders them into HTML output. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: the 'color' attribute value passed to the [faq] shortcode is written into the HTML DOM without sanitization (e.g., esc_attr() or wp_kses()) or escaping before output. The vulnerable code is located at line 65 of faq.php, visible in both the tagged 1.0 release and the trunk branch on the WordPress plugin repository. The CVSS scope change (S:C) reflects WordPress's multi-user architecture: a payload stored by one contributor executes in the security context of other, potentially higher-privileged, authenticated users who view the page.

RemediationAI

No vendor-released patched version is independently confirmed from the available data - the NVD references point only to the 1.0 tagged release and the trunk branch, with no higher version identified. Site administrators should check the WordPress plugin repository for any update beyond version 1.0 and apply it immediately if available. As a compensating control, revoke or audit Contributor-level accounts on the affected WordPress installation to ensure only trusted users hold that role; this directly eliminates the PR:L attack surface. Alternatively, deactivate or remove the faq shortcode plugin until a patched version is confirmed. A web application firewall (WAF) rule blocking script-bearing shortcode attribute values can reduce exposure but should not be treated as a complete fix. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ef6ce2ef-f810-4f8c-a0bd-785a28131213 should be monitored for patch release confirmation.