What is the CVSS score of CVE-2026-8887?

CVE-2026-8887 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Listen Shortcode CVE-2026-8887

EUVD-2026-32065 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-v269-5jmm-6x2p

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:29 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Listen Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'listen' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes (src, start, end) in the listenEmbedJS() function, which are echoed inside a single-quoted HTML attribute without escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Listen Shortcode WordPress plugin (versions ≤ 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts into pages via unsanitized shortcode attributes. The vulnerability exists in the listenEmbedJS() function, which echoes user-supplied src, start, and end attributes directly into a single-quoted HTML attribute context without escaping, enabling script injection that executes in the browsers of any user who later visits the affected page. EPSS is low (0.03%, 9th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, suggesting limited current exploitation activity.

Technical ContextAI

The Listen Shortcode plugin for WordPress implements a [listen] shortcode rendered by the listenEmbedJS() function (heganoo-shortcode.php, lines 22 and 43 per plugin Trac browser references). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the function accepts contributor-supplied shortcode attributes (src, start, end) and reflects them inside a single-quoted HTML attribute in generated markup without applying WordPress escaping functions such as esc_attr() or sanitize_text_field(). Because single-quoted attribute delimiters can be broken by injecting a closing single quote followed by an event handler or JavaScript URI, arbitrary script content can be embedded. This is a classic output-escaping failure in a WordPress shortcode handler. The CVSS Scope:Changed (S:C) designation reflects that successful injection affects the security context of other users' browsers, which is distinct from the contributor's own session.

RemediationAI

No vendor-released patch has been identified at time of analysis - no fixed version number appears in any of the available references, and the plugin Trac links point to trunk source rather than a tagged release. Site administrators should immediately deactivate and remove the Listen Shortcode plugin until a patched version is confirmed available. As a compensating control while awaiting a fix, restrict contributor-level registration on the WordPress site (Settings → General → Membership) to prevent untrusted users from accessing the shortcode. Additionally, a WordPress Web Application Firewall (WAF) such as Wordfence or similar can be configured to block XSS payloads in shortcode attribute parameters, though WAF bypass remains possible and is not a substitute for a code fix. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2c557615-148d-43a2-9fed-5f41faa7c64f for patch release notification. The proper code-level fix requires applying esc_attr() or wp_kses() to the src, start, and end shortcode attributes within listenEmbedJS() before they are rendered into HTML output.