What is the CVSS score of CVE-2026-8899?

CVE-2026-8899 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Auto Thumbnail CVE-2026-8899

EUVD-2026-32093 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-gpp6-4j5x-gp2c

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:30 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athn_thumbnails() function, which are concatenated directly into an HTML <img> tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Auto Thumbnail WordPress plugin (all versions up to and including 1.0) enables authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the 'width' and 'height' attributes of the 'thumbnails' shortcode. The injected payload executes in the browser of any subsequent visitor who loads the affected page, crossing trust boundaries from the WordPress server context into victims' sessions (CVSS S:C). No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog; EPSS of 0.03% (9th percentile) reflects low predicted exploitation probability, though the stored nature of the flaw amplifies impact relative to reflected XSS.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: the 'width' and 'height' attributes supplied to the 'thumbnails' shortcode are passed directly into the athn_thumbnails() function and concatenated into an HTML <img> tag without sanitization or output escaping. This is visible in the publicly browsable WordPress plugin Trac source at index.php lines 13 and 34 (tags/1.0). The changed scope (S:C) in the CVSS:3.1 vector is accurate for stored XSS because the injected script executes in the victim's browser context, which is a separate security principal from the WordPress application. Affected product confirmed by ENISA EUVD-2026-32093 as the 'automatic-thumbnail' plugin, versions 0 through 1.0 inclusive.

RemediationAI

No vendor-released patch has been identified in the available data at time of analysis - patch status cannot be confirmed. Administrators should immediately deactivate or uninstall the Auto Thumbnail plugin and monitor the Wordfence advisory page (https://www.wordfence.com/threat-intel/vulnerabilities/id/f0cc349a-96f9-4b11-a0b4-28bc4ccc022c) for a patched release. As a compensating control, restrict contributor-level WordPress accounts to explicitly trusted users, since the vulnerability requires at minimum contributor access to exploit; reducing the contributor population directly reduces attack surface. If the plugin cannot be disabled, deploying a WAF with XSS filtering rules (such as Wordfence's own firewall) can block malicious shortcode attribute payloads in transit, though this is not a code-level fix and may produce false positives on legitimate numeric attribute values. Audit existing posts and pages for suspicious content within 'thumbnails' shortcode width and height attributes to detect any prior injection.