What is the CVSS score of CVE-2026-8873?

CVE-2026-8873 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Content Slideshow CVE-2026-8873

EUVD-2026-32080 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-m2jj-4c8g-xgj3

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:28 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Content Slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Content Slideshow WordPress plugin (all versions through 2.4.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via shortcode attributes. The vulnerability resides in slideshow-widget-shortcode.php at multiple points (lines 14 and 143) where shortcode attribute values are passed without adequate sanitization or output escaping. The CVSS scope is Changed (S:C), meaning injected scripts execute in the victim's browser context and can affect resources beyond the plugin itself, such as stealing session tokens or performing actions as the visiting user. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at a very low 0.03%.

Technical ContextAI

The Content Slideshow plugin for WordPress implements a shortcode system that accepts user-supplied attributes rendered directly into page HTML. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the shortcode rendering logic within slideshow-widget-shortcode.php. WordPress shortcode attributes are a common injection surface when plugins fail to apply wp_kses(), esc_attr(), or esc_html() before outputting attribute values. The vulnerability appears at two distinct locations in the file (line 14 and line 143 per the NVD references to the 2.4.1 tag), suggesting multiple shortcode parameters are affected. The CVSS scope flag S:C is consistent with reflected or stored XSS that breaks out of the plugin's own context and can manipulate the broader WordPress page DOM, potentially targeting administrator sessions.

RemediationAI

No patched version number was confirmed in the available data - the NVD references point exclusively to the vulnerable 2.4.1 source tree, and no upgrade target is specified. Site administrators should check the WordPress plugin repository (wordpress.org/plugins/content-slideshow) for a version newer than 2.4.1 that addresses this issue, and consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/9548f647-9fcb-481c-874e-0184609283fe?source=cve for patch confirmation. If no patched version is yet available, the most effective compensating control is to deactivate and remove the Content Slideshow plugin until a fix is released. If the plugin cannot be removed, restrict contributor-level role assignment to only fully trusted users, as this prevents untrusted authenticated users from exploiting the shortcode injection surface. A Web Application Firewall rule targeting shortcode attribute injection patterns (e.g., Wordfence's built-in ruleset) can provide partial mitigation but is not a substitute for patching.