What is the CVSS score of EUVD-2026-29400?

EUVD-2026-29400 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Voyage Plus WordPress Plugin EUVD-2026-29400

| CVE-2026-5715 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-v96v-qjmp-rrrv

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:48 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Voyage Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'post-content' shortcode in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Voyage Plus WordPress plugin versions up to 1.0.6 allows authenticated contributors and above to inject malicious scripts via the 'class' attribute of the 'post-content' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages, enabling credential theft, session hijacking, or malware distribution. No public exploit code or active KEV listing identified at time of analysis, but the vulnerability requires only contributor-level access and no user interaction, making it practical for insider threats or compromised contributor accounts.

Technical ContextAI

The Voyage Plus plugin implements custom WordPress shortcodes, including 'post-content', which accept user-supplied attributes such as 'class' for CSS styling. The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS flaw where user input is stored in the WordPress database and later rendered in page HTML without proper escaping. The shortcode handler at inc/shortcodes.php line 194 directly interpolates the 'class' attribute into HTML output without using WordPress escaping functions like esc_attr() or wp_kses_post(). This allows authenticated users with contributor role (PR:L in CVSS) to craft payloads containing JavaScript that persist in the database and execute in victim browsers when the page is loaded, affecting all visitors regardless of their privilege level (Scope Change: C).

RemediationAI

Update the Voyage Plus plugin to the patched version released by the vendor (vendor-released patch version number not confirmed in provided references; verify latest stable version on WordPress.org plugin repository). If a patched release is not yet available, immediately restrict contributor-level user access to pages containing the 'post-content' shortcode or disable the shortcode entirely via a code filter (e.g., remove_shortcode('post-content')) until patched. For multi-author sites where contributor roles are essential, implement additional compensating controls: enable WordPress security plugins with shortcode and output sanitization rules, audit all pages using the shortcode for malicious injected content, and audit user role assignments to revoke unnecessary contributor access. Review the shortcode implementation at https://plugins.trac.wordpress.org/browser/voyage-plus/trunk/inc/shortcodes.php#L194 to ensure proper use of wp_kses_post() or esc_attr() on the 'class' attribute before output. Side effects of disabling the shortcode: site features relying on post-content styling will break until the plugin is patched and re-enabled.