What is the CVSS score of EUVD-2026-29396?

EUVD-2026-29396 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Next Date plugin EUVD-2026-29396

| CVE-2026-4920 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-p6f7-gpgm-52r8

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Next Date WordPress plugin (all versions up to 1.0) allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'default' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Next Date plugin processes user-supplied shortcode attributes without proper sanitization or escaping. Specifically, the 'default' attribute of the shortcode is rendered directly into the page output without sanitizing HTML/JavaScript content or applying WordPress escaping functions like esc_attr() or wp_kses_post(). This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where an authenticated user with contributor-level access or higher can persist malicious scripts in the WordPress database via shortcode attributes. When the page containing the shortcode is viewed by any site user, the injected JavaScript executes in their browser context, potentially allowing session hijacking, credential theft, or malware distribution.

RemediationAI

The primary mitigation is to update the Next Date plugin to a patched version if available from the developer. No specific patched version number is provided in the available data; WordPress administrators should check the plugin's update mechanism in the WordPress dashboard or the Wordfence vulnerability report for availability and version details. In the interim, disable the Next Date plugin entirely if not actively used, or restrict contributor-level user access to only trusted accounts if the functionality is required. Site administrators can implement a Web Application Firewall (WAF) rule to block shortcode attributes containing HTML/JavaScript patterns, though this may impact legitimate use cases. A compensating control is to disable shortcode processing for user-submitted content and only allow trusted administrators to create or edit posts containing the Next Date shortcode. The underlying fix requires the plugin developer to apply WordPress escaping functions (esc_attr() or wp_kses_post()) to the 'default' attribute output and sanitize input using sanitize_text_field() or wp_kses_post() at the time of shortcode processing.