What is the CVSS score of CVE-2026-8910?

CVE-2026-8910 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Emoticon Rating CVE-2026-8910

EUVD-2026-35313 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-09 Wordfence

GHSA-3wxc-x4qv-3xxg

CSRF WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:12 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.1

DescriptionCVE.org

The WP Emoticon Rating plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery combined with stored XSS in the WP Emoticon Rating WordPress plugin (all versions ≤ 1.0.1) allows unauthenticated remote attackers to persistently inject malicious scripts into site settings by tricking a logged-in administrator into clicking a crafted link. The CVSS Scope:Changed rating reflects that the injected payload executes beyond the admin context, potentially affecting all site visitors. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The WP Emoticon Rating plugin (CPE: cpe:2.3:a:rahulbhangale:wp_emoticon_rating:*:*:*:*:*:*:*:*) by developer rahulbhangale implements its administrative settings handler in wp-emo-admin.php. Wordfence's source references identify at least five functions at lines L18, L76, L101, L107, L130, and L136 of that file that process settings updates without properly verifying WordPress nonces - the framework-standard mechanism for binding a form submission to a specific authenticated session. CWE-352 (Cross-Site Request Forgery) is the root cause: because the server cannot distinguish a legitimate admin action from a forged one, any HTTP request that matches the expected form structure will be accepted. The secondary impact is XSS (settings injection), which achieves Scope:Changed because script payloads stored in plugin settings can render in the front-end browsing context, outside the admin dashboard where the CSRF was triggered.

RemediationAI

No vendor-released patched version has been identified in the available intelligence data; the CPE wildcard covering all versions through 1.0.1 suggests no fixed release exists at time of analysis. Administrators should check the WordPress plugin repository and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b2a0b560-3f5a-4d09-9cc1-e22b2a19dfe6?source=cve for patch availability. As an immediate compensating control, deactivate or uninstall the WP Emoticon Rating plugin entirely until a patched version is released - the trade-off is loss of emoticon rating functionality, which is acceptable given the XSS persistence risk. If the plugin must remain active, implement a Web Application Firewall rule (e.g., Wordfence Premium's CSRF protection) to block forged POST requests to the plugin's admin-ajax or options endpoints. Additionally, train administrators to avoid clicking unsolicited links while logged into the WordPress dashboard, and enforce shortest-session policies to reduce the CSRF attack window.