What is the CVSS score of EUVD-2026-11943?

EUVD-2026-11943 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of List Category Posts are affected by EUVD-2026-11943?

CVE-2026-32419 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 5.9. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate EUVD-2026-11943?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

List Category Posts EUVD-2026-11943

| CVE-2026-32419 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 Patchstack

WordPress XSS List Category Posts Wordpress Plugin

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11943

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.9

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fernando Briano List category posts list-category-posts allows DOM-Based XSS.This issue affects List category posts: from n/a through <= 0.93.1.

AnalysisAI

The List category posts WordPress plugin (versions through 0.93.1) contains a DOM-based cross-site scripting (XSS) vulnerability that allows authenticated attackers with high privileges to inject malicious scripts into web pages viewed by other users. An attacker can exploit this through improper input neutralization during web page generation, potentially leading to session hijacking, credential theft, or defacement. With a CVSS score of 5.9 and requiring high privileges plus user interaction, this represents a moderate-severity risk primarily to WordPress sites using this specific plugin.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically manifesting as DOM-based XSS where user-controlled input is not properly sanitized before being rendered in the Document Object Model of a web page. The affected product is the Fernando Briano List category posts plugin (CPE identifier: cpe:2.3:a:fernando_briano:list-category-posts), a WordPress plugin used to display categorized post listings. DOM-based XSS occurs when client-side JavaScript processes untrusted data without proper encoding or validation, allowing injected scripts to execute in the victim's browser within the security context of the affected page. This differs from reflected or stored XSS as the vulnerability exists in client-side code logic rather than server-side output.

RemediationAI

Immediately upgrade the List category posts plugin to version 0.93.2 or later if available, or verify with the plugin author for the next available patched version. Users should navigate to their WordPress dashboard, go to Plugins, search for List category posts, and select Update if available. If no patch has been released, disable the plugin until a security update is provided by Fernando Briano or consider migrating to an alternative WordPress post listing solution. As a temporary mitigation, restrict the plugin's administrative access to only trusted administrators with a documented need, implement Web Application Firewall rules to detect DOM-based XSS payloads, and maintain comprehensive browser security headers (Content-Security-Policy) to limit script execution scope. WordPress site administrators should also review user permissions and audit any accounts with high-level privileges.