What is the CVSS score of CVE-2026-8842?

CVE-2026-8842 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Google+ Link Name CVE-2026-8842

EUVD-2026-32058 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-qfxw-m6w6-p9j8

XSS WordPress Google

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:56 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Google+ Link Name plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gplusnamelink' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes ('id' and 'name') in the gplusnamelink_generate() function, which are concatenated directly into the rendered HTML without calling esc_attr() or esc_html(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'gplusnamelink' shortcode's 'id' and 'name' attributes. The root cause is the absence of WordPress output-escaping functions (esc_attr() or esc_html()) in the gplusnamelink_generate() function, permitting raw attribute values to be concatenated directly into rendered HTML. Scope is Changed (S:C) per CVSS, meaning the injected script executes in victims' browser sessions outside the plugin's own security context. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low observed exploitation probability.

Technical ContextAI

The vulnerability resides in the Google+ Link Name popup badge WordPress plugin (slug: google-plus-name-link-popup-badge), specifically in the gplusnamelink_generate() function located at trunk/gplusnamelink.php (lines 15 and 19 per plugin SVN references). CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied shortcode attributes 'id' and 'name' are interpolated into the HTML output without sanitization or contextual escaping. In WordPress plugin development, esc_attr() must be applied to attribute contexts and esc_html() to text node contexts before output; omitting these calls is a textbook CWE-79 pattern. The Changed scope in the CVSS vector (S:C) indicates that a successful exploit crosses a security boundary - victim browser sessions trust the origin of the injected page, enabling session hijacking, credential theft, or malicious redirects against any user who loads the affected page.

RemediationAI

No vendor-released patched version has been identified in the available data - the references link only to plugin source code on the WordPress SVN and the Wordfence advisory, neither of which specifies a fixed release version. Site administrators should check the WordPress plugin repository for an updated version and apply it immediately if available. As a compensating control, restrict the contributor role's ability to publish or edit content containing unreviewed shortcodes, using a plugin such as User Role Editor or Capability Manager Enhanced to limit who can insert arbitrary shortcodes. Alternatively, disable or remove the Google+ Link Name plugin entirely, as the underlying Google+ service was discontinued in 2019, making the plugin functionally obsolete for most deployments. A Web Application Firewall (WAF) rule targeting the gplusnamelink shortcode attributes can block exploitation attempts but will not remediate the underlying code flaw. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1643fe92-961c-40de-93c1-78cfeb09506d for patch release updates.