What is the CVSS score of CVE-2026-8837?

CVE-2026-8837 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Iframe Geo Style CVE-2026-8837

EUVD-2026-32054 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-m6c7-gxh5-93xf

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:55 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Iframe Geo Style for Amazon affiliates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'adid' Shortcode Attribute in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the WP Iframe Geo Style for Amazon affiliates WordPress plugin (all versions ≤1.1) allows authenticated attackers holding contributor-level roles to persist malicious JavaScript in page content via the unsanitized 'adid' shortcode attribute. The injected script executes automatically in any visitor's browser upon page load, with changed scope (S:C) confirming the payload crosses the attacker's own security boundary to impact other users. No public exploit identified at time of analysis, and an EPSS score of 0.03% (9th percentile) reflects low current exploitation probability, though the contributor-level access requirement is achievable on many open-registration WordPress sites.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), specifically the stored variant. The plugin processes a WordPress shortcode that accepts an 'adid' attribute; source code at index.php lines 42 and 110 (visible in the WordPress plugin repository at plugins.trac.wordpress.org) shows that this attribute is neither sanitized on input nor properly escaped on output before being rendered into HTML. Because the payload is stored server-side and reflected to all visitors of the affected page, it is classified as stored (persistent) XSS rather than reflected. The CVSS vector S:C (Scope Changed) is consistent with stored XSS mechanics: the attacker operates within the WordPress authoring context but the impact lands on a different principal - the site visitor's browser session.

RemediationAI

No specific patched version is identified in the available data; affected versions span all releases up to and including 1.1, and a fixed release version is not independently confirmed. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/030d65bb-ec5b-4d26-8f59-5db9a9005ba6?source=cve for the latest patch status and to determine if an updated plugin version has been released. As a compensating control while awaiting a patch, restrict contributor-level role assignments to fully trusted users only - this eliminates the attack surface since PR:L is a hard prerequisite. Alternatively, disable the shortcode functionality via a site-level content filter or a capability restriction plugin, though this will break the Amazon affiliate iframe display feature for all users. Deploying a web application firewall rule targeting the 'adid' shortcode attribute with script-injection patterns (e.g., Wordfence's own WAF rule) provides partial mitigation without disabling functionality.