What is the CVSS score of CVE-2026-8871?

CVE-2026-8871 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Formidable Kinetic CVE-2026-8871

EUVD-2026-32076 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-5p7x-57xg-6p8v

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:27 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Formidable Kinetic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'kinetic_link' shortcode in versions up to, and including, 1.1.01. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes (notably 'window', 'class', and 'label') in the FrmKinetic::link() function, which are concatenated directly into HTML attributes of an anchor tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Formidable Kinetic WordPress plugin (versions ≤1.1.01) allows authenticated attackers with contributor-level access to permanently inject malicious scripts into pages via the 'kinetic_link' shortcode. The FrmKinetic::link() function concatenates user-supplied shortcode attributes ('window', 'class', 'label') directly into anchor tag HTML attributes without sanitization or output escaping, meaning any visitor who loads an injected page triggers execution of the attacker's payload in their browser. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.03% (9th percentile) reflects low automated exploitation probability, but the Changed scope (S:C) in the CVSS vector indicates the impact crosses the plugin's security boundary into the broader WordPress page context.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), specifically in the FrmKinetic::link() function within formidable-kinetic.php (visible at plugins.trac.wordpress.org lines 34 and 70). WordPress shortcodes process user-supplied attributes server-side and render them into HTML; when those attributes are concatenated directly into HTML tag attributes without wp_kses, esc_attr, or equivalent sanitization, any contributor-level WordPress user who can insert shortcodes can embed arbitrary JavaScript event handlers or data URIs. The S:C (Changed Scope) in the CVSS vector reflects that the XSS payload escapes the plugin's own execution context and runs in the victim's browser session - potentially targeting higher-privileged users such as editors or administrators who view the injected page. The affected CPE corresponds to the Formidable Kinetic WordPress plugin, all releases from version 0 through 1.1.01 inclusive, as confirmed by ENISA EUVD-2026-32076.

RemediationAI

No vendor-released patched version has been identified in the available data - the NVD references point solely to plugin source code on WordPress Trac and the Wordfence advisory, neither of which confirms a fixed release version. Site owners should check the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6f849ec6-1c90-4f98-a367-fea87ddc5870 for an updated release. As an immediate compensating control, restrict contributor-level accounts from inserting shortcodes by using a plugin such as Shortcode Guard or by auditing which user roles have shortcode execution permissions - note this may break legitimate editorial workflows. Alternatively, disable or deactivate the Formidable Kinetic plugin entirely until a patched version is available; this removes the vulnerable shortcode handler at the cost of any link-rendering functionality the plugin provides. Wordfence firewall users should verify that a firewall rule covering this vulnerability is active, as Wordfence often ships virtual patches ahead of official plugin updates.