What is the CVSS score of CVE-2026-8624?

CVE-2026-8624 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

LJ Comments Import Reloaded CVE-2026-8624

EUVD-2026-31015 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-20 Wordfence

GHSA-r7gc-qvc7-g642

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:41 vuln.today

DescriptionCVE.org

The LJ comments import: reloaded plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 0.97.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability arises specifically because PHP_SELF includes attacker-controllable PATH_INFO appended to the script name, and there are two distinct unsanitized echo points for this value in the same function.

AnalysisAI

Reflected XSS in the LJ Comments Import: Reloaded WordPress plugin (all versions ≤ 0.97.1) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by exploiting two distinct unsanitized echo points for the PHP_SELF variable in lj_comments_import.php (lines L129 and L161). The attack requires tricking an authenticated WordPress user into clicking a crafted link, making session hijacking and unauthorized administrative actions the primary post-exploitation risk. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L, PR:N) and Changed scope make this a realistic threat to sites where the plugin is active.

Technical ContextAI

PHP_SELF is a PHP superglobal that reflects the currently executing script's path, and critically includes any PATH_INFO appended by the web server after the script filename in the URL. When an application echoes PHP_SELF without HTML encoding, an attacker can embed a JavaScript payload directly in the URL path segment (e.g., /lj_comments_import.php/<script>alert(1)</script>), which the server includes verbatim in PHP_SELF. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class. The Wordfence disclosure identifies two separate echo points in the same function - at lines L129 and L161 of lj_comments_import.php - meaning both locations independently render the attacker-controlled value without sanitization or output escaping. The affected CPE is cpe:2.3:a:etspring:lj_comments_import:_reloaded:*:*:*:*:*:*:*:* covering the etspring vendor's plugin on WordPress.

RemediationAI

No patched version has been confirmed in the available data - patch status cannot be independently verified from the provided references, and no fixed release version is cited in the Wordfence advisory or CPE data. WordPress administrators should immediately check the WordPress plugin repository for an updated release beyond 0.97.1 and monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0f09cb59-dbbb-48a3-aeac-377f6ec87b88 for patch confirmation. If no patch is available, the most effective compensating control is to deactivate and remove the plugin entirely, eliminating the attack surface without side effects. Alternatively, a WAF rule blocking requests where PATH_INFO contains angle brackets, script tags, or URI-encoded equivalents targeting lj_comments_import.php will prevent payload delivery but may also block legitimate edge-case requests. Sites running Wordfence Premium, Care, or Response should have firewall rules automatically updated per the Wordfence disclosure timeline.