What is the CVSS score of EUVD-2026-22868?

EUVD-2026-22868 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-22868

| CVE-2026-4005 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Wordfence

GHSA-953c-p36c-7pc3

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 09:09 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 09:00 euvd

EUVD-2026-22868

Analysis Generated

Apr 15, 2026 - 09:00 vuln.today

CVE Published

Apr 15, 2026 - 08:28 nvd

MEDIUM 6.4

DescriptionCVE.org

The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() on the 'userhash' parameter, which strips HTML tags but does not escape characters significant in a JavaScript string context (such as double quotes, semicolons, and parentheses). The sanitized value is then directly interpolated into a JavaScript string within a <script> tag on line 29 without any JavaScript-specific escaping (e.g., wp_json_encode() or esc_js()). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Coachific Shortcode plugin for WordPress versions up to 1.0 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the 'userhash' shortcode attribute. The plugin sanitizes input with sanitize_text_field() but fails to apply JavaScript-specific escaping before interpolating the value into a script tag, enabling persistent XSS attacks visible to all page visitors. EPSS score of 6.4 reflects moderate real-world risk constrained by the requirement for authenticated contributor access and user interaction.

Technical ContextAI

The vulnerability stems from improper output encoding in WordPress plugin development. The Coachific Shortcode plugin (CPE: cpe:2.3:a:coachific:coachific_shortcode:*:*:*:*:*:*:*:*) uses sanitize_text_field() to strip HTML tags from the 'userhash' parameter on line 13, but this WordPress sanitization function does not escape JavaScript metacharacters such as quotes, semicolons, and parentheses that are significant in string contexts. The sanitized value is then directly embedded into a JavaScript string literal within a script tag on line 29 without applying JavaScript-specific escaping functions like esc_js() or wp_json_encode(). This violates the principle of context-aware output encoding; developers must apply different escaping rules depending on whether content is rendered as HTML, JavaScript, CSS, or a URL. The CWE-79 classification (Improper Neutralization of Input During Web Page Generation) correctly identifies the root cause as insufficient input validation combined with unsafe output rendering.

RemediationAI

The plugin developer must apply JavaScript-specific escaping to the 'userhash' parameter before interpolating it into the script tag. Replace the current sanitize_text_field() approach with esc_js() or wp_json_encode() followed by safe embedding in the JavaScript string context. The recommended immediate fix is to update the plugin to version 1.1 or later (once released by the developer) which applies proper output escaping. In the interim, site administrators should restrict contributor-level access to trusted users only and monitor contributor activity logs for suspicious shortcode usage. For detailed remediation guidance, consult the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3d91158c-0b34-460e-9fdb-b99165ebca78?source=cve and review the vulnerable code references at https://plugins.trac.wordpress.org/browser/coachific-shortcode/trunk/coachific.php.