What is the CVSS score of EUVD-2026-20846?

EUVD-2026-20846 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress EUVD-2026-20846

| CVE-2026-5742 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 Wordfence

GHSA-88ch-mr98-cfqw

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 04:30 euvd

EUVD-2026-20846

Analysis Generated

Apr 09, 2026 - 04:30 vuln.today

CVE Published

Apr 09, 2026 - 03:25 nvd

MEDIUM 6.4

DescriptionCVE.org

The UsersWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.2.60. This is due to insufficient input sanitization of user-supplied URL fields and improper output escaping when rendering user profile data in badge widgets. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts that will execute whenever a user accesses a page containing the affected badge widget.

AnalysisAI

Stored Cross-Site Scripting in UsersWP WordPress plugin up to version 1.2.60 allows authenticated subscribers and above to inject arbitrary JavaScript into user profile badge widgets via insufficiently sanitized URL fields, executing malicious scripts for all site visitors viewing affected pages. The vulnerability affects the badge widget rendering component due to improper output escaping in the wp-ayecode-ui library integration. No public exploit code or active exploitation has been identified, though the low attack complexity and subscriber-level access requirement make this a realistic threat in multi-user WordPress environments.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the UsersWP plugin's badge widget implementation. The root cause involves two distinct failures: insufficient input sanitization of user-supplied URL fields stored in the database and inadequate output escaping when rendering profile data through the wp-ayecode-ui component library, specifically in the AUI button component class. The affected code is located in class-aui-component-button.php (line 53 onwards) and pages.php (lines 392-540, particularly lines 522-527), which handle badge widget generation. When a user with subscriber-level or higher permissions submits a profile update containing malicious JavaScript within URL fields, the unescaped output is stored and subsequently rendered to all site visitors, resulting in persistent client-side code execution within the security context of the affected WordPress site.

RemediationAI

Upgrade the UsersWP plugin to a patched version released after 1.2.60 that includes input sanitization and output escaping fixes. The WordPress plugin repository changeset referenced (3501691@userswp) indicates upstream patches have been applied; users should update to the latest available version from the WordPress.org plugin directory. If an immediate upgrade is not feasible, site administrators should restrict subscriber-level user permissions on profile editing and disable the badge widget feature until patching is complete. Review audit logs for suspicious profile modifications by subscriber-level accounts that may indicate exploitation. For additional guidance, refer to the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bdb619c5-967c-4b8c-8a93-bcdb49137d56?source=cve and the WordPress plugin repository source code references detailing the vulnerable components.