What is the CVSS score of CVE-2026-8707?

CVE-2026-8707 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

NS Product icon badge CVE-2026-8707

EUVD-2026-32087 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-528r-cr6g-9874

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:54 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.1

DescriptionCVE.org

The NS Product icon badge plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting in the NS Product icon badge WordPress plugin (all versions through 1.2.4) enables unauthenticated remote attackers to inject arbitrary JavaScript via the PHP_SELF superglobal, which is reflected into page output without sanitization or escaping across at least four code locations in ns_addNewOptionsPage.php. Exploitation requires convincing a victim (typically an authenticated WordPress admin) to click a crafted link, limiting mass exploitation but enabling targeted session hijacking or credential theft against site administrators. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.09% (26th percentile) indicates low current exploitation probability.

Technical ContextAI

The vulnerability resides in the PHP_SELF superglobal, which returns the script's path from the HTTP request URI and is directly user-controllable by manipulating the URL. The affected plugin file ns_addNewOptionsPage.php fails to sanitize or escape this value before reflecting it into HTML at lines 101, 123, 209, and 228 - multiple injection points across the same file. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause as missing output encoding at render time, a fundamental WordPress plugin hardening requirement. The CVSS vector's Changed scope (S:C) reflects that injected scripts execute in the victim's browser context, potentially crossing the boundary from the plugin page into broader WordPress admin capabilities.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the highest known version (1.2.4) remains vulnerable per all source data. Site administrators should immediately deactivate and remove the NS Product icon badge plugin until a patched version is confirmed available. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d1c1847c-8cc9-4080-8da5-7364c4358034 for patch availability. As a compensating control, restrict admin area access to known IP ranges using server-level rules (e.g., nginx or Apache allow/deny directives), which reduces the ability of attackers to deliver crafted links to sessions that can reach the plugin's options pages. Web Application Firewalls with XSS rulesets can block common PHP_SELF injection patterns in transit but should not be treated as a primary control given filter bypass techniques. Note: deactivating the plugin may remove badge display functionality from product listings.