What is the CVSS score of CVE-2026-8867?

CVE-2026-8867 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Post Category Gallery CVE-2026-8867

EUVD-2026-32095 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-8px5-75f8-5vhw

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:03 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (such as total_width, color_scheme, and caption_font_size) inside the sc_horcatbar() function, which are concatenated directly into HTML attribute values. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Post Category Gallery WordPress plugin (versions ≤1.0.0) allows authenticated attackers holding contributor-level access or above to inject persistent malicious scripts via unsanitized shortcode attributes. The injected payload executes in the browsers of any user who visits the affected page, enabling session hijacking, credential theft, or privilege escalation against higher-privileged users such as administrators. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% (9th percentile) indicates very low automated exploitation probability.

Technical ContextAI

The vulnerability resides in the sc_horcatbar() function within horcatbar.php (lines 79 and 97 per the WordPress plugin trac repository). Shortcode attributes - specifically total_width, color_scheme, and caption_font_size - passed to the 'postcategorygallery' shortcode are concatenated directly into HTML attribute values without application of WordPress output escaping functions such as esc_attr(). CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: user-controlled data reaches a browser rendering context without encoding. The CVSS scope metric S:C (Changed) reflects that the injected script executes in the security context of the victim's browser session rather than the attacker's, crossing a trust boundary inherent to the WordPress post rendering pipeline. No CPE string was provided in the available intelligence data; affected software is identified as Post Categories Gallery ≤1.0.0 per ENISA EUVD-2026-32095.

RemediationAI

No vendor-released patched version was identified in the available intelligence data - the fix version is not independently confirmed and should be verified against the WordPress.org plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f439718e-4a3d-4dc9-a16c-6b655480dde6. Until a confirmed patched release is available, site administrators should disable or fully uninstall the Post Category Gallery plugin; disabling prevents shortcode rendering while preserving data, whereas uninstalling removes the attack surface entirely. As a compensating control, strictly audit and restrict contributor-level role assignments to only verified, trusted users, since exploitation is gated on PR:L authentication - reducing the contributor population directly reduces exposure, though this does not eliminate risk from compromised accounts. Deploying a WAF rule (e.g., Wordfence firewall) to flag or block requests containing script injection patterns in the 'postcategorygallery' shortcode attributes provides an additional detection layer, though WAF bypass is possible with obfuscated payloads. Monitor the Wordfence advisory and WordPress plugin changelog for a patched release.