What is the CVSS score of EUVD-2026-24636?

EUVD-2026-24636 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Institute Management EUVD-2026-24636

| CVE-2026-2714 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-4mj3-26h4-xjcm

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:00 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24636

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.4

DescriptionCVE.org

The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versions up to, and including, 5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in Institute Management plugin for WordPress up to version 5.5 allows authenticated administrators to inject arbitrary JavaScript via the 'Enquiry Form Title' setting, which executes when users access affected pages. The vulnerability is limited to multi-site WordPress installations or sites with unfiltered_html disabled. CVSS 4.4 reflects high privilege requirements (PR:H) and conditional scope (multi-site only), but the stored XSS nature and administrator access requirement make this a targeted insider threat rather than a broad attack surface.

Technical ContextAI

The Institute Management plugin (Weblizar) fails to properly sanitize and escape user input in the 'Enquiry Form Title' administrative setting before storing and rendering it in page output. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. The root cause is insufficient use of WordPress escaping functions (such as esc_attr() or esc_html()) when outputting the setting value. The vulnerability only manifests in specific WordPress configurations: multi-site installations where capabilities are distributed across sites, or installations where the unfiltered_html capability has been explicitly disabled (common on shared hosting and security-hardened environments). CPE cpe:2.3:a:weblizar:institute_management_-_learning_management_system identifies the affected plugin across all versions through 5.5.

RemediationAI

Patch to Institute Management plugin version 5.6 or later (vendor patch version not explicitly confirmed in provided data; verify latest release at WordPress plugin repository). The fix applies proper escaping/sanitization to the Enquiry Form Title setting in wl_im_settings.php. No workarounds are practical for multi-site or unfiltered_html-disabled environments short of disabling the plugin. Immediate mitigation: restrict Administrator role to trusted users only and review admin account activity logs for unauthorized setting changes. For single-site installations with unfiltered_html enabled (default), risk is eliminated by configuration but patching is still recommended for defense-in-depth. Update via WordPress admin dashboard Plugins > Updates or download from https://plugins.trac.wordpress.org/browser/institute-management/.