What is the CVSS score of CVE-2026-9022?

CVE-2026-9022 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Splide Carousel Block CVE-2026-9022

EUVD-2026-32042 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-vhfj-2685-88x2

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:36 vuln.today

CVE Published

May 27, 2026 - 04:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Splide Carousel Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'url' Block Attribute in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload must be published before it executes for site visitors, which requires an editor or administrator to approve and publish the contributor's post.

AnalysisAI

Stored Cross-Site Scripting in the Splide Carousel Block WordPress plugin (all versions ≤ 1.7.1) allows authenticated attackers with contributor-level access to inject persistent JavaScript via the 'url' block attribute, executing against any visitor of the affected page. The attack requires the malicious post to be published by an editor or administrator before the payload fires, adding a social-engineering or workflow-abuse dependency. With an EPSS of 0.03% (9th percentile) and no current CISA KEV listing, real-world exploitation risk is low but non-negligible on sites permitting untrusted contributors to submit content.

Technical ContextAI

The vulnerability resides in the Splide Carousel Block WordPress plugin, a Gutenberg block that renders carousel/slider components. The affected code paths are the carousel-item block (build/carousel-item/index.js) and its view renderer (build/carousel/view.js), where the 'url' block attribute is passed to the DOM without adequate sanitization or contextual output escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied attribute values are reflected into rendered HTML without encoding, allowing script injection. In the WordPress block editor model, block attributes are stored in post content as HTML comments or inline props, meaning the malicious value persists in the database and executes on every page load - the defining characteristic of stored (persistent) XSS versus reflected variants. The changed scope (S:C in CVSS) is expected for XSS: the vulnerable component is the server-side plugin, but the impact lands in the victim's browser context.

RemediationAI

An upstream code change is available via WordPress plugin repository changeset 3537643 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3537643%40splide-carousel&new=3537643%40splide-carousel), which addresses the insufficient sanitization of the 'url' attribute. The exact released version number containing this fix was not confirmed in the available data - site administrators should update to the latest available version of Splide Carousel Block via the WordPress admin dashboard and verify the installed version exceeds 1.7.1. The Wordfence advisory at the URL above should be monitored for version confirmation. As a compensating control pending upgrade, site administrators can restrict contributor-level roles from creating or editing pages that use the Splide Carousel Block, or disable the plugin entirely until patched. Restricting contributor access via a role-management plugin (e.g., revoking block-editor access) reduces exposure without removing the plugin, though this may impact legitimate content workflows.