What is the CVSS score of EUVD-2026-22865?

EUVD-2026-22865 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-22865

| CVE-2026-3998 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Wordfence

GHSA-qq42-h26h-x735

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:09 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22865

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The generate_jqMathFormula() function directly concatenates the 'style' attribute value into an HTML style attribute without applying esc_attr() or any other escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in WM JqMath WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'style' shortcode attribute, which executes in the browsers of all users viewing affected pages. The vulnerability stems from direct concatenation of unsanitized user input into HTML without proper escaping (missing esc_attr() calls). CVSS 6.4 reflects moderate risk with scope change; no public exploit code or active KEV status identified at time of analysis.

Technical ContextAI

WM JqMath is a WordPress plugin that renders mathematical formulas using the jqMath library. The vulnerability exists in the generate_jqMathFormula() function, which processes the [jqmath] shortcode. WordPress shortcode attributes are user-controlled when edited by authenticated users with Contributor role or higher. The plugin fails to apply WordPress's esc_attr() sanitization function before embedding the 'style' attribute value directly into HTML output. This is a classic Stored XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) where the malicious payload persists in post/page content and executes every time the page loads. The affected CPE (cpe:2.3:a:webmindpt:wm_jqmath:*:*:*:*:*:*:*:*) covers all versions through 1.3.

RemediationAI

Disable or remove the WM JqMath plugin immediately if not required. If the plugin is essential, check for version 1.4 or later, which should include input sanitization fixes (e.g., application of esc_attr() to the 'style' attribute before output). Consult the plugin's changelog or the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/b4aebb45-b47b-4b5a-8281-400a4b786689) for the exact patched version. As an interim workaround, restrict Contributor-level access to users who are trusted, and audit existing posts/pages using [jqmath] shortcodes for suspicious style attribute values. Implement a Content Security Policy (CSP) header to mitigate inline script injection where possible, though this does not fully replace patching. Review and remove any suspicious shortcode content that may have been injected by less-trusted contributors.