What is the CVSS score of CVE-2026-8701?

CVE-2026-8701 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

GNTT Title Ticker CVE-2026-8701

EUVD-2026-32066 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-qmwf-2v6g-8m26

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:34 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The GNTT Post Title Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the title-ticker-slide, title-ticker-fade, and title-ticker-typing shortcodes. This is due to insufficient input sanitization and output escaping on shortcode attributes (notably border, width, height, header_background, header_text_color, and id) within the gntt_title_ticker_slide(), gntt_title_ticker_fade(), and gntt_title_ticker_typing() functions. None of these attribute values are passed through esc_attr() or any other escaping function before being concatenated into HTML output. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the GNTT Post Title Ticker WordPress plugin version 1.0 allows authenticated contributors to inject persistent malicious JavaScript via unsanitized shortcode attributes across three display functions. The vulnerability arises from direct HTML concatenation of user-controlled values - including border, width, height, header_background, header_text_color, and id - without any escaping in gntt_title_ticker_slide(), gntt_title_ticker_fade(), and gntt_title_ticker_typing(). No public exploit has been identified at time of analysis, and the EPSS exploitation probability stands at a low 0.03%, suggesting limited real-world interest despite an accessible contributor-level attack surface on multi-author WordPress sites.

Technical ContextAI

The GNTT Post Title Ticker plugin (version ≤ 1.0) provides WordPress shortcodes for animated post title display: [title-ticker-slide], [title-ticker-fade], and [title-ticker-typing]. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the failure to apply WordPress's standard esc_attr() escaping function to shortcode attribute values before they are concatenated into HTML markup. The vulnerable attribute handling is observable directly in the plugin's SVN source at gntt-post-title-ticker.php (approximately lines 29 and 56 per the trac browser references). Any WordPress user with the capability to insert shortcodes into content - contributor role and above - can supply attribute values containing JavaScript event handlers or inline script tags that persist in the WordPress database and execute in every subsequent visitor's browser when the affected page loads.

RemediationAI

No vendor-released patch has been identified at time of analysis. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/37f8eced-905c-4623-b382-055561fd25a0 should be monitored for patch availability and upgrade guidance. The most effective immediate compensating control is to deactivate and remove the GNTT Post Title Ticker plugin until a patched release is published, eliminating the attack surface entirely at the cost of the ticker display functionality. If the plugin must remain active, restrict the WordPress roles permitted to author or edit posts to Editor or Administrator level, preventing contributors from inserting the vulnerable shortcodes - note this limits collaborative authorship workflows. As a detection step, administrators should audit all existing posts and pages for unexpected use of the title-ticker-slide, title-ticker-fade, and title-ticker-typing shortcodes to identify any previously injected payloads.