What is the CVSS score of CVE-2026-8872?

CVE-2026-8872 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Animate Your Content CVE-2026-8872

EUVD-2026-32074 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-9vgm-7xvx-g4wx

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:28 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Animate Your Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'animation-set' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_args_to_html_attrs() function, which concatenates shortcode attribute values directly into double-quoted HTML attributes without calling esc_attr(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Animate Your Content WordPress plugin (versions ≤ 1.0.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts into pages via the 'animation-set' shortcode. The injected payload executes in the browsers of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and EPSS (0.03%, 9th percentile) together with SSVC exploitation status of 'none' indicate this is currently a low-priority, low-activity vulnerability.

Technical ContextAI

The vulnerability resides in the shortcode_args_to_html_attrs() function within the plugin's plugin.php file (referenced at lines 88, 116, and 135 in the WordPress plugin trac repository for animate-your-content/trunk). This function processes user-supplied shortcode attributes from the 'animation-set' shortcode and concatenates their values directly into double-quoted HTML attribute strings without first passing them through WordPress's esc_attr() sanitization function. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting) is the root cause class: unescaped attacker-controlled data flows from shortcode input into rendered HTML, allowing attribute-breaking payloads (e.g., closing a double-quote and injecting an event handler like onmouseover=alert(1)) to execute as JavaScript. The scope change (S:C in the CVSS vector) reflects that the injected script executes in the victim's browser context, crossing trust boundaries from the WordPress backend to the user's browser session.

RemediationAI

No vendor-released patched version has been identified in the available data - the fix version is not independently confirmed from the provided references or NVD CPE entries. Site administrators should monitor the WordPress plugin repository (plugins.trac.wordpress.org/browser/animate-your-content) and the Wordfence advisory at wordfence.com/threat-intel/vulnerabilities/id/5d7fd79f-8113-4143-b630-46531e574fc9 for a patched release and apply it as soon as one is available. As an immediate compensating control, deactivate or remove the Animate Your Content plugin entirely until a fix is confirmed - this eliminates the attack surface with no material side effects unless the 'animation-set' shortcode is actively used in published content. If the plugin cannot be removed, restrict contributor-level role assignment to fully trusted users only, since the exploit requires at minimum that privilege level. A WAF rule targeting shortcode attribute injection patterns in POST requests to wp-admin can provide partial mitigation but should not be relied upon as a primary defense.