What is the CVSS score of EUVD-2026-13992?

EUVD-2026-13992 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-13992?

Organizations using all should be aware of moderate risk from CVE-2026-2496, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-13992?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-13992

| CVE-2026-2496 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-27xg-j8cm-6xf2

GHSA-5xrj-cq63-86fg

GHSA-8g8c-j78f-p955

GHSA-cmqc-mg69-6c29

GHSA-hr7m-wrqw-583q

GHSA-rpmg-26wm-r5vr

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-13992

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Ed's Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's eds_font_awesome shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Ed's Font Awesome plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the eds_font_awesome shortcode due to insufficient input sanitization and output escaping of user-supplied attributes. All versions up to and including 2.0 are affected, allowing authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript that persists in pages and executes for all users viewing those pages. No evidence of active exploitation in the wild (KEV status unknown), but the vulnerability is straightforward to exploit given contributor access and represents a persistent compromise vector.

Technical ContextAI

The vulnerability exists in the Ed's Font Awesome WordPress plugin (CPE: cpe:2.3:a:waianaeboy702:ed's_font_awesome:*:*:*:*:*:*:*:*), specifically in the eds_font_awesome shortcode handler as evidenced by references to line 103 of eds_font_awesome.php in both the trunk and version 2.0 tag. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. WordPress shortcodes process user-supplied attributes from page/post content; when these attributes are not properly sanitized before database storage or escaped before output to HTML, attackers can embed malicious scripts. The plugin fails to apply WordPress's sanitization functions (e.g., sanitize_text_field) on input or escaping functions (e.g., wp_kses_post, esc_attr) on output, allowing script injection through shortcode parameters.

RemediationAI

The primary remediation is to upgrade Ed's Font Awesome plugin to a version patched after 2.0 if available from the WordPress plugin repository (https://wordpress.org/plugins/eds-font-awesome/). If no patched version exists, disable or remove the plugin entirely. As an interim mitigation, restrict contributor-level access to only trusted users and review all existing pages/posts containing the eds_font_awesome shortcode for injected content. WordPress administrators should audit user roles, consider reducing contributor permissions to Editor or Author roles with further restrictions, and implement a Web Application Firewall (WAF) rule to detect script tags within shortcode attributes. For sites unable to patch immediately, monitor database queries for shortcode parameter injection patterns and implement Content Security Policy (CSP) headers to mitigate XSS payload execution impact.