What is the CVSS score of EUVD-2026-29916?

EUVD-2026-29916 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Snow Monkey Blocks EUVD-2026-29916

| CVE-2026-3004 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-13 Wordfence

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 13, 2026 - 08:30 vuln.today

CVE Published

May 13, 2026 - 07:44 nvd

MEDIUM 6.4

DescriptionCVE.org

The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute in all versions up to, and including, 24.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Snow Monkey Blocks WordPress plugin up to version 24.1.11 allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript via the 'data-slick' attribute, which executes in the browsers of all users who view the affected pages. The vulnerability stems from insufficient input sanitization and output escaping in block rendering functionality. CVSS 6.4 reflects the moderate severity; exploitation requires prior authentication and contributor access, limiting the attack surface to trusted WordPress users or accounts obtained through compromise.

Technical ContextAI

Snow Monkey Blocks is a WordPress block plugin (cpe:2.3:a:inc2734:snow_monkey_blocks:*:*:*:*:*:*:*:*) that extends the Gutenberg editor with custom block types. The vulnerability exists in the plugin's handling of the 'data-slick' HTML attribute, which is likely used to pass configuration to the Slick carousel JavaScript library. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied attribute values are rendered into page markup without adequate sanitization (input validation/filtering) or output escaping (HTML entity encoding). When a Contributor-level user saves a page or post containing a malicious 'data-slick' value, the unsanitized payload is stored in the WordPress database and executed client-side whenever any user (including administrators or readers) views that page.

RemediationAI

Update Snow Monkey Blocks to version 24.1.12 or later, which is expected to include input sanitization and output escaping fixes for the 'data-slick' attribute. Installations should immediately navigate to WordPress Plugins admin panel, locate Snow Monkey Blocks, and trigger the update if available via the automatic update mechanism or manual file replacement from the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset/3519092/. As a temporary compensating control pending patch deployment, restrict Contributor-level plugin access via WordPress role management (Settings → Users or via a role/capability plugin) to a minimal set of trusted users, and use WordPress security plugins to audit and monitor who has Contributor access. Note that this workaround does not prevent exploitation if an existing Contributor account is compromised; it only reduces the attack surface. Additionally, scan existing published posts and pages using the WordPress plugin code at https://plugins.trac.wordpress.org/browser/snow-monkey-blocks/trunk/snow-monkey-blocks.php for any 'data-slick' attributes containing suspicious JavaScript syntax and remove or edit affected content.