What is the CVSS score of CVE-2026-8048?

CVE-2026-8048 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

My Email Shortcode CVE-2026-8048

EUVD-2026-32075 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-xfvh-hhg7-h477

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:30 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The My Email Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subject' shortcode attribute in the 'my-email' shortcode in all versions up to, and including, 0.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the My Email Shortcode WordPress plugin (versions up to and including 0.91) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts via the 'subject' attribute of the 'my-email' shortcode. The Changed scope in the CVSS vector (S:C) confirms that successful exploitation crosses security boundaries, affecting visiting users' browser sessions regardless of their own privilege level. No active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.03% at the 9th percentile indicates low observed exploitation probability at time of analysis.

Technical ContextAI

The vulnerability resides in the My Email Shortcode WordPress plugin, which provides a [my-email] shortcode for embedding email functionality in posts and pages. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure to sanitize the 'subject' shortcode attribute before rendering it into page output and a failure to apply proper output escaping. The vulnerable code path is confirmed at line 37 of my-email-shortcode.php (both the 0.91 tagged release and trunk), where user-controlled shortcode attribute values are reflected into rendered HTML without adequate escaping. WordPress shortcode attributes are processed server-side and stored as part of post content, making this a stored (persistent) XSS rather than a reflected variant - injected payloads persist until the content is edited or removed.

RemediationAI

No confirmed patched release version is identifiable from the available data - the NVD references include both the vulnerable 0.91 tag and the trunk branch of the plugin repository, suggesting an upstream fix may be in progress but a formally released patched version has not been confirmed. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6c9f5515-cdf5-4883-bdeb-1de53bcc615a for a confirmed patched release and upgrade immediately upon availability. As an interim compensating control, administrators should restrict the ability to publish or edit posts containing shortcodes to trusted roles only (Editor and above), effectively removing Contributor-level access to shortcode insertion. Alternatively, the plugin can be deactivated entirely until a fix is confirmed - this eliminates risk at the cost of losing the shortcode functionality. Sites using the Wordfence firewall should ensure their rules are current, as Wordfence typically deploys WAF rules for vulnerabilities it reports.