What is the CVSS score of EUVD-2026-24648?

EUVD-2026-24648 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

ER Swiffy Insert EUVD-2026-24648

| CVE-2026-4082 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-f7h9-vgfr-v594

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 09:59 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24648

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 6.4

DescriptionCVE.org

The ER Swiffy Insert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [swiffy] shortcode in all versions up to and including 1.0.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes ('n', 'w', 'h'). These attributes are extracted using extract() and directly interpolated into the HTML output without any escaping such as esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the ER Swiffy Insert WordPress plugin through version 1.0.0 allows authenticated users with Contributor access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes that are directly interpolated into page output. The vulnerability affects all versions of the plugin and requires only contributor-level privileges to exploit, making it a persistence and privilege-escalation vector on WordPress sites with multiple user accounts.

Technical ContextAI

The ER Swiffy Insert plugin uses PHP's extract() function to unpack shortcode attributes ('n', 'w', 'h') directly into variable scope without sanitization. These extracted variables are then interpolated into HTML output via string concatenation without WordPress escaping functions such as esc_attr() or esc_html(). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS pattern where untrusted user input is rendered in a security-relevant context without encoding. The vulnerability exists in the shortcode handler, which processes user-supplied content at render time.

RemediationAI

Update the ER Swiffy Insert plugin to a patched version when available from the WordPress plugin repository, or disable and remove the plugin if no update is released. Immediate mitigation for site administrators includes restricting Contributor-level access to only trusted users, removing unnecessary Contributor accounts, and auditing existing page content for injected scripts. Implement a Web Application Firewall (WAF) rule to detect and block shortcode attributes containing script tags or event handlers. Monitor user activity logs for unexpected shortcode additions. Review the WordPress security best practices at https://wordpress.org/support/article/hardening-wordpress/. Sites should also enable WordPress plugin auto-updates if possible to receive patched versions automatically once released.