What is the CVSS score of EUVD-2026-28541?

EUVD-2026-28541 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

NMR Strava Activities EUVD-2026-28541

| CVE-2026-5341 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-08 Wordfence

GHSA-7929-xh7v-8jrh

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 10:30 vuln.today

CVE Published

May 08, 2026 - 09:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's strava_nmr_connect shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in the NMR Strava Activities WordPress plugin through version 1.0.14 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the strava_nmr_connect shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, compromising session security and enabling account takeover or malware distribution. A vendor patch addressing the vulnerability is available in version 1.0.15.

Technical ContextAI

The vulnerability exists in the shortcode handler for strava_nmr_connect within the NMR Strava Activities plugin (CPE: cpe:2.3:a:mirceatm:nmr_strava_activities:*:*:*:*:*:*:*:*), which integrates Strava fitness tracking data into WordPress sites. The underlying issue is a failure to properly sanitize and escape user-supplied shortcode attributes before rendering them in HTML output. This is a classic example of CWE-79 (Improper Neutralization of Input During Web Page Generation), where an attacker controls input that flows directly into the DOM without validation or encoding. The WordPress shortcode API accepts arbitrary attribute key-value pairs; the plugin parses these attributes but does not apply WordPress sanitization functions (sanitize_text_field, wp_kses_post) during input processing or escaping functions (esc_attr, esc_html, wp_kses_post) during output. By embedding script tags or event handlers in shortcode attributes, an attacker can break out of the intended context and execute JavaScript in victim browsers.

RemediationAI

Update the NMR Strava Activities plugin to version 1.0.15 or later immediately. WordPress administrators should navigate to Plugins → Installed Plugins, locate 'NMR Strava Activities', and click 'Update Now' if available, or manually download version 1.0.15 from the WordPress Plugin Repository and upload it via SFTP or the WordPress admin interface. No workarounds are recommended prior to patching, as this is a stored XSS flaw affecting all site visitors; attempting to sanitize existing malicious shortcode content via database queries is error-prone without understanding the exact injection vectors. As an interim compensating control only if immediate patching is not possible, restrict the 'Contributor' role via the User Role Editor plugin or by disabling user registration temporarily, but this is not a substitute for patching. After upgrading, verify that the shortcode attribute handling in nmr-strava-activities.php lines 240-251 (in version 1.0.15) includes proper escaping functions such as esc_attr() or wp_kses_post(). Scan the site's database for existing malicious shortcode instances using tools like Wordfence or manually querying wp_posts for suspicious [strava_nmr_connect patterns with script tags or event handlers.