What is the CVSS score of CVE-2026-8875?

CVE-2026-8875 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Easy Prism Syntax Highlighter CVE-2026-8875

EUVD-2026-32083 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-pm23-26vr-fhmc

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:16 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' (and 'c') shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the shortcode() function, which concatenates the first positional attribute directly into the class attribute of the generated <pre>/<code> HTML without calling esc_attr() or any other escaping function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Easy Prism Syntax Highlighter WordPress plugin (versions ≤1.0.2) enables authenticated attackers with Contributor-level access to inject persistent JavaScript into WordPress pages via the 'code' or 'c' shortcode. The flaw resides in the shortcode() function, which concatenates the first positional shortcode attribute directly into the class attribute of generated <pre> and <code> HTML elements without invoking esc_attr() or any equivalent escaping - enabling HTML attribute breakout and arbitrary script injection. No public exploit has been identified and EPSS is very low (0.03%, 9th percentile), but the Contributor-level authentication threshold makes this accessible on any multi-author WordPress site without additional barrier.

Technical ContextAI

The Easy Prism Syntax Highlighter plugin wraps the Prism.js client-side syntax highlighting library, exposing a [code] and [c] shortcode for WordPress content authors. The vulnerable logic is in PrismSyntaxHighlither.php at lines L116 and L123, where the shortcode() function takes the first positional attribute (intended as a language identifier such as 'php' or 'javascript') and interpolates it directly into the class attribute string of the output <pre> or <code> element. Because WordPress's esc_attr() is never called on this value, an attacker can close the attribute, inject additional attributes (e.g., event handlers like onmouseover or onfocus), or embed inline script content. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) is the precise root cause class. The CVSS scope indicator S:C (Changed) reflects that the injected script executes in victims' browsers under the context of the affected WordPress origin, crossing the security boundary from the contributing author's session to all site visitors.

RemediationAI

Upgrade the Easy Prism Syntax Highlighter plugin to a version beyond 1.0.2 once a patched release is confirmed available via the WordPress plugin repository. As of this analysis, no specific patched version number has been independently confirmed from the available data - the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/aa690c4d-15c4-43bc-b8f7-017b7741c5cd should be consulted for the authoritative fix version when published. As an immediate compensating control while awaiting a patch, deactivate the Easy Prism Syntax Highlighter plugin entirely - this eliminates the attack surface with no data loss, though it will render [code] and [c] shortcode blocks inert on existing pages. Alternatively, use a shortcode access-control plugin (e.g., Shortcode Access Manager) to restrict the [code] and [c] shortcodes to Editor-level or higher roles, raising the authentication bar and significantly reducing exposure; note this does not fix the underlying flaw. Additionally, audit existing published content for suspicious class attribute payloads within <pre> and <code> blocks as part of an incident assessment.