What is the CVSS score of CVE-2026-8895?

CVE-2026-8895 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

kk Blog Card CVE-2026-8895

EUVD-2026-35317 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-xjx5-r76f-rx6c

PHP XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:15 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on the shortcode's 'href' and 'type' attributes, which are concatenated directly into HTML attribute contexts in the shortcode callback registered in kk-blog-card-shortcode.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the kk Blog Card WordPress plugin (all versions ≤ 1.3) allows authenticated contributors to inject persistent JavaScript payloads via unsanitized 'href' and 'type' attributes of the [blog-card] shortcode. The flaw, rooted in direct attribute concatenation without sanitization or escaping in kk-blog-card-shortcode.php, executes injected scripts in the browser of any visitor loading an affected page - including administrators. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the changed scope (S:C) in the CVSS vector elevates potential impact beyond the plugin boundary.

Technical ContextAI

The kk Blog Card plugin (CPE: cpe:2.3:a:kenz60:kk_blog_card:*:*:*:*:*:*:*:*) registers a [blog-card] shortcode callback in kk-blog-card-shortcode.php (lines 4 and 8 per the WordPress plugin repository source). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): the shortcode handler concatenates attacker-supplied values for the 'href' and 'type' attributes directly into HTML output without applying WordPress sanitization functions (such as esc_attr() or sanitize_url()) or output escaping. In WordPress's shortcode architecture, attribute values are user-controlled strings passed at post/page creation time; failing to neutralize them at render time allows injection of event handlers or javascript: URI schemes into the HTML attribute context. The PHP tag in the metadata confirms this is a server-side PHP rendering issue.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the CPE wildcard (*) in the NVD entry and the absence of a fixed version in the Wordfence advisory both indicate no safe release was available at disclosure. The primary recommended action is to deactivate and remove the kk Blog Card plugin until a patched version is confirmed available; monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f6ccddd4-89fe-4786-917b-944185b4510b for patch status. As a compensating control short of removal, audit and restrict contributor-level account assignments to fully trusted users only - since the attack requires a minimum of contributor access, eliminating untrusted contributor accounts reduces the attack surface, though it does not remediate the underlying flaw and does not protect against compromised legitimate accounts. Site owners using a Web Application Firewall with WordPress ruleset (such as Wordfence's own firewall) may benefit from virtual patching rules targeting the [blog-card] shortcode attribute injection pattern.