What is the CVSS score of EUVD-2026-14154?

EUVD-2026-14154 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14154?

Organizations using all should be aware of moderate risk from CVE-2026-2837, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate EUVD-2026-14154?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14154

| CVE-2026-2837 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-hpfx-9vj4-xr9j

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14154

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Ricerca - advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ricerca - advanced search WordPress plugin affecting all versions up to and including 1.1.12, caused by insufficient input sanitization and output escaping in the plugin's settings interface. Only authenticated administrators on multi-site WordPress installations or those with unfiltered_html disabled are able to inject malicious scripts that execute for all users viewing affected pages. The CVSS score of 4.4 reflects the requirement for high-privilege administrative access and specific configuration conditions, though the impact remains meaningful given the scope of affected multi-site deployments.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application input validation flaw. The Ricerca plugin, identified via CPE (cpe:2.3:a:systemsrtk:ricerca_–_advanced_search:*:*:*:*:*:*:*:*), fails to properly sanitize user input received through its administrative settings fields and does not adequately escape output when rendering those settings in plugin pages. The vulnerability manifests in the admin_fields.php component (referenced in the WordPress plugin repository at line 689), which processes administrator-provided configuration values without adequate security controls. This affects only specific WordPress configurations: multi-site installations where site administrators can modify plugin settings, or single-site installations where the unfiltered_html capability has been explicitly disabled, preventing the default HTML filtering that would normally block injected scripts.

RemediationAI

Update the Ricerca – advanced search plugin to a version newer than 1.1.12 immediately (check the official WordPress plugin repository for the latest patched version). Until an update is available or can be deployed, restrict administrative access to only trusted personnel and regularly audit plugin settings for any suspicious or unexpected content. On multi-site WordPress installations, consider temporarily disabling the Ricerca plugin if it is not critical to operations, or ensure that only highly trusted administrators have access to modify its settings. Additionally, enable and maintain WordPress security hardening practices including using security plugins that provide Content Security Policy (CSP) headers to mitigate stored XSS impact, and ensure unfiltered_html capability remains disabled on installations where feasible to provide defense-in-depth protection.