What is the CVSS score of EUVD-2026-14190?

EUVD-2026-14190 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by EUVD-2026-14190?

Organizations using all should be aware of moderate risk from CVE-2026-3996, a cross-site scripting vulnerability rated CVSS 6.4.

How to fix or mitigate EUVD-2026-14190?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress EUVD-2026-14190

| CVE-2026-3996 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-4274-9vhj-c283

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14190

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'width', 'height', 'src', 'title', 'description', 'game_url', 'main', and 'thumb', which are all directly concatenated into HTML output without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

The WP Games Embed WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 0.1beta due to insufficient input sanitization and output escaping of shortcode attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript through shortcode parameters such as 'width', 'height', 'src', 'title', 'description', 'game_url', 'main', and 'thumb', which are directly concatenated into HTML output without escaping. When other users visit pages containing the malicious shortcode, the injected scripts execute in their browsers, potentially allowing session hijacking, credential theft, or malware distribution.

Technical ContextAI

The vulnerability stems from a failure to implement proper output encoding in a WordPress plugin handling user-supplied shortcode attributes. WordPress shortcodes are a templating mechanism that allows users to embed dynamic content, and the [game] shortcode handler in WP Games Embed (identified via CPE cpe:2.3:a:sammyb:wp_games_embed:*:*:*:*:*:*:*:*) directly embeds unescaped attribute values into HTML context. The root cause falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS vulnerability class. The plugin fails to use WordPress escaping functions such as esc_attr() for HTML attributes or esc_url() for URL attributes, allowing HTML and JavaScript syntax to pass through unfiltered. Multiple code locations in wp-games-embed.php (lines 14, 32, 35, and 41 per references) concatenate these attributes directly into output, compounding the exposure across multiple injection vectors.

RemediationAI

The primary remediation is to upgrade the WP Games Embed plugin to a patched version or disable the plugin if no patch is available. Site administrators should immediately update via the WordPress plugin dashboard or install a fixed release from the plugin repository if the vendor has issued one. As a temporary workaround pending plugin updates, restrict Contributor-level role assignments to trusted authors only, and audit existing contributors to remove unnecessary permissions. Additionally, implement a Web Application Firewall (WAF) rule to detect and block shortcode attributes containing script tags or event handlers, and consider using a security plugin such as Wordfence or Sucuri to scan for stored malicious content already injected into post or page content. Administrators without a patch should disable or remove the WP Games Embed plugin entirely until a security update is released and thoroughly tested in a staging environment before production deployment.