What is the CVSS score of EUVD-2026-20121?

EUVD-2026-20121 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-20121

| CVE-2026-5506 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-pff6-574p-8mfv

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20121

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 6.4

DescriptionCVE.org

The Wavr plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wave shortcode in all versions up to, and including, 0.2.6. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Wavr WordPress plugin up to version 0.2.6 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with malicious scripts executing for all users who view affected pages. CVSS 6.4 reflects moderate severity with network-accessible attack vector and cross-site impact; no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The Wavr plugin implements a custom wave shortcode handler that processes user-supplied attributes without proper input sanitization or output escaping, violating WordPress security best practices. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), where untrusted data from shortcode parameters flows directly into page output. The affected code paths at lines 82 and 99 in wavr.php lack WordPress escaping functions such as esc_attr(), esc_html(), or esc_js(), allowing attackers to bypass HTML context boundaries. The CPE identifier (cpe:2.3:a:lucascaro:wavr:*:*:*:*:*:*:*:*) indicates all versions of the Lucascaro Wavr plugin are affected through at least version 0.2.6.

RemediationAI

Update the Wavr plugin to a version released after 0.2.6 that includes proper input sanitization and output escaping. WordPress site administrators should check the plugin repository and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d8987bc5-2bc0-4a92-bcf0-cc3245e15bed for the latest patched version. As an interim mitigation, restrict contributor-level WordPress role assignment to trusted users only, and monitor user role assignments closely. Additionally, implement a Web Application Firewall (WAF) rule to block requests containing script tags in shortcode attributes, though this does not replace patching. Review the fixed code paths at plugins.trac.wordpress.org/browser/wavr to verify that all shortcode attribute output is wrapped with appropriate WordPress escaping functions (esc_attr, esc_html, etc.) before updating to production.