What is the CVSS score of CVE-2026-8885?

CVE-2026-8885 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

DeMomentSomTres Shortcodes CVE-2026-8885

EUVD-2026-33893 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-02 Wordfence

GHSA-h266-v67x-4ccc

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 08:50 vuln.today

CVE Published

Jun 02, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1. This is due to insufficient input sanitization and output escaping on the 'width' and 'align' shortcode attributes within the st_callout() function, which concatenates the attribute values directly into an HTML style attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the DeMomentSomTres Shortcodes WordPress plugin (all versions through 1.1.1) allows authenticated attackers with contributor-level access to persistently inject arbitrary JavaScript into page content via the 'callout' shortcode's 'width' and 'align' attributes. The injected payload executes in the browsers of any subsequent visitor to the affected page, enabling session hijacking, credential theft, or malicious redirects scoped to the WordPress front-end. No public exploit has been identified at time of analysis, and the CVSS Scope:Changed rating reflects that the impact extends beyond the attacker's own session to affect other users.

Technical ContextAI

The vulnerability resides in the st_callout() function of the DeMomentSomTres Shortcodes plugin (CPE: cpe:2.3:a:marcqueralt:demomentsomtres_shortcodes:*:*:*:*:*:*:*:*), as confirmed by WordPress plugin Trac source references at lines 163 and 173 of demomentsomtres-shortcodes.php. The function accepts 'width' and 'align' shortcode attributes and concatenates their values directly into an inline HTML style attribute string without applying sanitization (e.g., esc_attr()) or output escaping. This falls squarely under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the Stored variant, because the unsanitized input is persisted in the WordPress database as post content and rendered to all viewers. The WordPress shortcode API does not automatically sanitize attribute values, placing the responsibility entirely on the plugin author, which was not fulfilled here.

RemediationAI

No vendor-released patched version has been identified in the available data - the advisory covers all versions through 1.1.1 with no confirmed fix release. Site administrators should check the WordPress plugin repository for an updated version beyond 1.1.1 and apply it immediately if available. As a compensating control pending a patch, administrators should disable the DeMomentSomTres Shortcodes plugin entirely; this eliminates the attack surface at the cost of losing all shortcode functionality provided by the plugin. If the plugin cannot be disabled, restrict contributor-level role assignment to fully trusted users only and audit existing contributor accounts for signs of unauthorized access. Additionally, deploying a Web Application Firewall (WAF) rule to block shortcode attribute injection patterns can reduce exploitation probability, though this is not a substitute for a code-level fix. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/8f09f239-dd6e-4fc0-b656-f8c73b7e9022?source=cve should be monitored for patch release updates.