What is the CVSS score of EUVD-2026-14174?

EUVD-2026-14174 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-14174?

Organizations using all should be aware of moderate risk from CVE-2026-1908, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-14174?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14174

| CVE-2026-1908 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-rww4-4g7g-fx67

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14174

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Integration with Hubspot Forms WordPress plugin (all versions up to 1.2.2) due to insufficient input sanitization and output escaping on shortcode attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages via the 'hubspotform' shortcode, which executes whenever users access the compromised page. While no public exploit-in-the-wild activity has been reported, the vulnerability is straightforward to exploit and poses a moderate risk given the low privilege requirement and broad attack surface in WordPress environments.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Stored XSS flaw. The affected product is the Integration with Hubspot Forms plugin (CPE: cpe:2.3:a:minnur:integration_with_hubspot_forms:*:*:*:*:*:*:*:*) for WordPress, specifically the EmbedHubspotForms.php component at line 183 where shortcode attributes are processed. The plugin fails to properly sanitize user-supplied input and escape output when rendering the [hubspotform] shortcode, allowing malicious script injection. WordPress shortcodes are a core templating mechanism that developers often mishandle regarding security; improper attribute handling in shortcode callbacks is a recurring vulnerability class in the WordPress ecosystem.

RemediationAI

Upgrade the Integration with Hubspot Forms plugin to version 1.2.3 or later, which should address the input sanitization and output escaping defects. WordPress administrators should immediately check the plugin repository for patch availability and apply updates across all affected installations. As an interim measure, restrict the [hubspotform] shortcode to trusted administrators only by implementing a custom post type or editorial review workflow requiring approval before pages containing the shortcode are published. Additionally, limit Contributor-level access to only trusted team members and monitor post revisions for unauthorized shortcode injection using WordPress security plugins (e.g., Wordfence, Sucuri) that detect XSS patterns. See https://www.wordfence.com/threat-intel/vulnerabilities/id/aac2b2a3-5d4f-449f-876c-d1bec295e088?source=cve for vendor advisories and patch status.