EUVD-2026-35299
GHSA-3xrw-mxp7-2r3j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the GBMI_Calc_Widget::widget() function. Shortcode attributes are extracted directly into local variables via @extract($args) and then echoed unescaped into an HTML style attribute (height/width) and HTML body context (title), allowing attribute-breakout payloads. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Global Body Mass Index Calculator WordPress plugin (versions up to and including 1.2) allows authenticated contributors to persistently inject arbitrary JavaScript into any page rendering the 'gbmicalc' shortcode. The vulnerability arises from PHP's @extract() call on unsanitized shortcode attributes followed by unescaped output into both an HTML style attribute context and an HTML body context inside GBMI_Calc_Widget::widget(), enabling attribute-breakout payloads. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the Wordfence-confirmed contributor-level requirement makes this a realistic risk for any multi-author WordPress installation.
Technical ContextAI
The affected component is the GBMI_Calc_Widget::widget() function within the Global Body Mass Index Calculator WordPress plugin, developed by vendor 'helpstring' (CPE: cpe:2.3:a:helpstring:global_body_mass_index_calculator:*:*:*:*:*:*:*:*). The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). PHP's @extract($args) extracts all shortcode attributes directly into local variable scope without any sanitization step; those variables are subsequently echoed unescaped into an HTML style attribute controlling height and width values (gbmicalc.php lines ~335 and ~345) and into an HTML body context for the title parameter (line ~476). The style-attribute injection context enables attribute-breakout payloads - for example, a closing quote followed by an event handler - while the title context permits direct script-tag injection. CVSS scope is rated S:C (Changed) because the stored script executes in the victim's browser security context rather than the attacker's, crossing the trust boundary from the contributor's session into that of any subsequent page visitor.
RemediationAI
No vendor-released patch has been identified at time of analysis - all source code references point exclusively to the vulnerable 1.2 release, and no later tagged version appears in the plugin repository. The primary remediation is to deactivate or uninstall the Global Body Mass Index Calculator plugin immediately; this eliminates the attack surface entirely at the cost of the BMI calculator functionality on affected pages. If deactivation is operationally infeasible, restrict contributor-role assignment to fully trusted users only, since the attack requires at minimum that role - this limits exploitation to credentialed insiders and substantially reduces real-world risk, though it does not fix the underlying flaw. Deploying a Web Application Firewall with plugin-specific rules targeting 'gbmicalc' shortcode attribute injection patterns (Wordfence provides rule coverage for its advisory findings) offers partial mitigation with the caveat that WAF rules can be bypassed by sufficiently obfuscated payloads. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06804bed-17c5-413c-a31b-f6f039015e26 for a patched release and apply it immediately upon availability.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today