What is the CVSS score of EUVD-2026-27195?

EUVD-2026-27195 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP-Clippy EUVD-2026-27195

| CVE-2026-5505 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-05 Wordfence

GHSA-fj9f-47hw-34fv

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The WP-Clippy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's clippy shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in WP-Clippy plugin for WordPress up to version 1.0.0 allows authenticated attackers with contributor-level access or higher to inject arbitrary JavaScript via the clippy shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

WP-Clippy is a WordPress plugin (CPE: cpe:2.3:a:bitacre:wp-clippy:*:*:*:*:*:*:*:*) that provides a shortcode named clippy for embedding interactive elements. The vulnerability exists in the shortcode handler's processing of user-supplied attributes, which are reflected in page output without proper sanitization (via sanitize_text_field() or equivalent) or escaping (via esc_attr(), wp_kses(), or esc_html() as appropriate). This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) flaw. The shortcode processing code in wp-clippy.php (lines 23 and 26 referenced in the WordPress plugin repository) directly outputs attribute values without neutralizing HTML/JavaScript metacharacters.

RemediationAI

Update WP-Clippy to a patched version released after 1.0.0; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ec49ed83-a09d-460d-be34-0fb79032b543 for the specific fix version and release date. If an updated version is not yet available, the immediate workaround is to deactivate and remove the WP-Clippy plugin from all affected WordPress installations. For sites requiring the plugin's functionality pending a patch, restrict contributor role permissions to users with demonstrable need and implement code-level fixes by manually escaping all shortcode attributes using WordPress functions such as esc_attr() or wp_kses() before output; this requires modifying the plugin's wp-clippy.php file directly and carries the risk of being overwritten on plugin update. Alternatively, use a Web Application Firewall (WAF) rule to detect and block requests containing shortcode patterns with suspicious attribute syntax (e.g., [clippy ... onclick=, [clippy ... onerror=), though this may block legitimate use if attribute names are complex.