What is the CVSS score of CVE-2026-8896?

CVE-2026-8896 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Mir Blocks and Shortcodes CVE-2026-8896

EUVD-2026-38682 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-c2xc-5vpx-hhx9

WordPress XSS Wordpress Plugin Mir Blocks And Shortcodes

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires victim page-load, so UI:R is correct; all other metrics match the provided vector.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:00 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 6.4

DescriptionCVE.org

The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes such as 'ready_animation_text') of the 'msc_stats' shortcode in versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes inside the msc_stats() rendering function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Mir Blocks and Shortcodes WordPress plugin (versions up to and including 1.0.0) allows authenticated attackers with contributor-level access to permanently inject arbitrary JavaScript into pages via unsanitized shortcode attributes - specifically the 'title' and 'ready_animation_text' parameters of the msc_stats() rendering function. Any site visitor who loads an injected page executes the attacker's script in their browser, enabling session theft, credential harvesting, or in-page content manipulation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low privilege requirement (contributor) makes this accessible to a broad class of registered WordPress users.

Technical ContextAI

The vulnerability exists in the msc_stats() PHP rendering function of the Mir Blocks and Shortcodes plugin (vendor: mirsoftware; CPE cpe:2.3:a:mirsoftware:mir_blocks_and_shortcodes:*:*:*:*:*:*:*:*), specifically at lines L22 and L44 of frontend-templates/function/msc-stats.php as referenced by the WordPress plugin Trac browser. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied shortcode attribute values are passed into HTML output without adequate sanitization (stripping or encoding dangerous characters on input) or escaping (context-appropriate encoding on output). WordPress shortcodes are processed server-side but their attribute values are reflected into rendered HTML that browsers execute, making this a classic stored XSS vector. The scope change (S:C in the CVSS vector) is accurate - the attacker operates within WordPress's plugin execution context, but the impact materializes in the victim's browser, a separate security boundary.

RemediationAI

No vendor-released patch is identified at time of analysis. Site administrators should immediately deactivate and remove the Mir Blocks and Shortcodes plugin until a patched version is released and confirmed. As a compensating control, restrict contributor-level role assignments to fully trusted users, since this is the minimum privilege threshold for exploitation - reducing the contributor user pool is the most direct way to limit attack surface without removing the plugin entirely. If the plugin must remain active, consider implementing a Web Application Firewall rule to block shortcode attribute injection patterns in POST bodies, though this carries risk of false positives with legitimate content. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d7d698be-fae6-4960-912a-1078ea407031 and the WordPress.org plugin page for a patched release. Review existing pages using the msc_stats shortcode for previously injected payloads.