EUVD-2026-32061
GHSA-www3-xfc6-4q8f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The GBI To Print plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0 via the 'div' attribute of the 'gbitoprint' shortcode. This is due to insufficient output escaping in the gbi_toprint_shortcode() function, which concatenates the raw shortcode attribute value directly into an HTML attribute without applying esc_attr() or any other sanitization. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the GBI To Print WordPress plugin version 1.0 allows authenticated attackers with contributor-level access to inject persistent malicious scripts into WordPress pages via the unsanitized 'div' attribute of the 'gbitoprint' shortcode. The root cause is a direct concatenation of raw shortcode attribute input into HTML output inside gbi_toprint_shortcode() at gbitoprint.php line 86, with no call to esc_attr() or equivalent WordPress sanitization. Any site visitor loading a page containing the injected shortcode will execute the attacker-controlled script in their browser, enabling session theft, credential harvesting, or malicious redirects. No public exploit code has been identified at time of analysis, and EPSS signals low near-term mass exploitation probability.
Technical ContextAI
The vulnerability resides in the GBI To Print WordPress plugin (version 1.0 and below), specifically in the PHP function gbi_toprint_shortcode() defined at gbitoprint.php line 86. WordPress shortcodes accept user-supplied attributes which are then used to render HTML. The plugin takes the 'div' attribute value and concatenates it directly as an HTML attribute value without invoking WordPress's standard esc_attr() sanitization helper or any equivalent encoding. This is a textbook instance of CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), subtype: Stored XSS. Because WordPress contributor-level users have the capability to insert shortcodes in posts and pages, they can craft a shortcode whose 'div' attribute contains a closing-quote sequence followed by an event handler (e.g., onmouseover) or a script injection. The payload is stored in the database and reflected to every subsequent visitor of the affected page, placing this firmly in the Stored (Persistent) XSS category with Changed scope (S:C) in CVSS terms, meaning the injected script runs in the victim's browser security context rather than the server's.
RemediationAI
No vendor-released patch has been identified at time of analysis for GBI To Print version 1.0. Site administrators should immediately deactivate and remove the GBI To Print plugin until a patched release is published. As a compensating control, restrict the WordPress contributor role so that untrusted users cannot create or edit posts containing arbitrary shortcodes - this can be enforced via capability management plugins (e.g., Members or User Role Editor) by removing the 'edit_posts' capability from the contributor role, though this will prevent legitimate contributor publishing workflows. Additionally, a Web Application Firewall rule targeting XSS payloads in shortcode attributes (e.g., via Wordfence's built-in firewall or a CDN-layer WAF) can reduce exploitation surface. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/28102544-3a33-4f15-af62-714e7dab42b7 and the WordPress plugin repository for a patched release, at which point upgrading immediately is the definitive fix.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today