What is the CVSS score of CVE-2026-8703?

CVE-2026-8703 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Endless Scroll CVE-2026-8703

EUVD-2026-32057 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-gcxf-jwh3-gv9h

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:53 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Endless Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Endless Scroll WordPress plugin (all versions ≤1.0.0) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via shortcode attributes, which execute in any visitor's browser upon page load. The CVSS scope change (S:C) confirms the payload crosses security boundaries - executing outside the WordPress application context - enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit has been identified at time of analysis, and EPSS at 0.03% (9th percentile) reflects very low current exploitation probability, though the low privilege bar (contributor role) elevates risk on sites with open or loosely managed user registration.

Technical ContextAI

The vulnerability resides in the Endless Scroll WordPress plugin's shortcode attribute rendering pipeline. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) identifies the root cause as a failure to sanitize user-supplied shortcode attribute values on input and to HTML-escape them on output before injection into rendered page markup. WordPress shortcodes process contributor-authored content, making this attack surface relevant to any multi-author site. The vulnerable logic is pinpointed by the NVD references to lines 54 and 58 of the plugin's trunk/index.php in the WordPress SVN repository (https://plugins.trac.wordpress.org/browser/endless-scroll/trunk/index.php#L54 and #L58). Because the payload is stored server-side and re-rendered on every page load, the attack is persistent and affects all subsequent visitors - not just the initial request.

RemediationAI

No confirmed patched release version appears in any of the available intelligence sources - administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b56f54b-978e-41ea-8cbe-846facb71cd3 and the WordPress plugin repository for an updated release. The primary compensating control is to deactivate and remove the Endless Scroll plugin until a patched version is confirmed; removal eliminates the attack surface entirely with no functional trade-off beyond losing the plugin's scrolling feature. If removal is not immediately feasible, restrict the contributor role exclusively to fully trusted users and audit existing contributor accounts - this directly closes the PR:L attack vector but does not eliminate the underlying code vulnerability. Sites running the Wordfence security plugin may benefit from its virtual patching firewall rules (note: free-tier rules are delayed 30 days relative to the premium tier). Blocking shortcode execution for untrusted roles via capability filtering is a more surgical control but requires custom code and carries a risk of breaking other shortcode-dependent functionality.