What is the CVSS score of CVE-2026-9644?

CVE-2026-9644 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

LiveSmart Video Chat CVE-2026-9644

EUVD-2026-32724 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 security@wordfence.com

GHSA-xwq2-5xq4-c9j9

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 06:33 vuln.today

CVE Published

May 28, 2026 - 06:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The LiveSmart Video Chat Live Video Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livesmart_widget' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the LiveSmart Video Chat WordPress plugin (all versions through 1.2) allows authenticated contributors to inject persistent malicious scripts via the 'livesmart_widget' shortcode attribute, which execute in any visitor's browser upon page load. The CVSS Scope:Changed rating confirms cross-user impact - a contributor's injected payload can hijack administrator sessions, exfiltrate cookies, or perform unauthorized actions on behalf of higher-privileged victims. No public exploit code and no CISA KEV confirmation exist at time of analysis, but the low privilege bar (contributor-level) meaningfully widens the realistic attacker pool on multi-author WordPress deployments.

Technical ContextAI

WordPress shortcodes are server-side macros processed by registered handler functions; any attribute values passed in shortcode markup are user-controlled. The 'livesmart_widget' shortcode handler in versions through 1.2 fails to sanitize input attributes before storing them and omits output escaping when rendering attribute values into HTML - the root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation). Standard WordPress hardening for shortcodes requires calling 'esc_attr()', 'esc_html()', or 'wp_kses()' on all user-supplied values before output; the plugin bypasses these controls entirely. Because the payload is stored in the WordPress database (Stored XSS), it persists and fires for every subsequent page view without further attacker interaction. No CPE string was supplied in the intelligence data; affected scope is constrained to WordPress installations running the plugin at or below version 1.2.

RemediationAI

An upstream code fix is available via the WordPress.org plugin Trac changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3539257%40new-dev-livesmart-video-chat&new=3539257%40new-dev-livesmart-video-chat), however a specific patched release version number is not independently confirmed from the available intelligence data - administrators should verify the latest available version in the WordPress plugin directory and update beyond 1.2 immediately. As a compensating control pending an update, audit and restrict contributor-level role assignments to only explicitly trusted users, since the attack mandates at minimum contributor access; removing open registration eliminates the self-service attacker onboarding path, though note this may affect legitimate site workflows. Deactivating the plugin entirely eliminates the attack surface at the cost of losing all LiveSmart video chat functionality. A WAF rule blocking script-injection patterns in WordPress shortcode attribute parameters can provide partial mitigation but should not substitute for patching, as bypass techniques exist. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a3798336-e63b-4ede-9e4d-09a28249ea46 for any updated remediation guidance.