What is the CVSS score of CVE-2026-8847?

CVE-2026-8847 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Dideo Plugin CVE-2026-8847

EUVD-2026-32089 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-mh8g-7vv3-fqfp

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:00 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute without escaping in the dideo() shortcode handler. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Dideo plugin for WordPress version 1.0 allows authenticated contributors to inject persistent malicious scripts into any page using the 'dideo' shortcode. The 'id' shortcode attribute is interpolated directly into an HTML iframe 'src' attribute without sanitization or output escaping in the dideo() handler, meaning injected payloads execute automatically in the browser of any user who visits the affected page. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) reflects low current exploitation interest, but the stored nature and scope-changed CVSS vector (S:C) elevate concern for multi-author WordPress deployments.

Technical ContextAI

The vulnerability resides in the wp-dideo WordPress plugin (version ≤ 1.0), specifically in the dideo() shortcode handler. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause class: the plugin accepts a user-supplied 'id' attribute from the WordPress shortcode API and directly concatenates it into an HTML iframe 'src' attribute without applying wp_kses(), esc_attr(), or equivalent WordPress sanitization functions. The affected code is visible at plugins.trac.wordpress.org/browser/wp-dideo/trunk/dideo.php at lines 13 and 17. WordPress's shortcode API does not sanitize attribute values by default - that responsibility falls entirely on the plugin. The CVSS scope-changed designation (S:C) reflects that the vulnerability's impact escapes the plugin component itself and reaches the end-user's browser context, consistent with stored XSS behavior.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed version is referenced in any of the available source data including NVD, EUVD, or the Wordfence advisory. Site administrators should immediately deactivate and uninstall the Dideo plugin until a patched release is available. As a compensating control, restrict contributor-level role assignment to only fully trusted users, as WordPress's contributor role is the minimum threshold for exploitation. If the embedded video functionality is operationally required, consider replacing the plugin with an alternative that passes security review, or implement a Content Security Policy (CSP) header with a restrictive frame-src and script-src directive to reduce the blast radius of stored XSS payloads - note that CSP does not eliminate the vulnerability but can prevent script execution in compliant browsers. Monitor the Wordfence advisory page and the WordPress.org plugin page for patch availability.