What is the CVSS score of EUVD-2026-31407?

EUVD-2026-31407 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Blockade EUVD-2026-31407

| CVE-2026-3481 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-22 Wordfence

GHSA-p9mp-xq3w-289v

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 05:17 vuln.today

DescriptionCVE.org

The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14. This is due to insufficient input sanitization and output escaping in the render_shortcode_preview() function. The function receives user input from $_GET['shortcode'], passes it through stripslashes() without any sanitization, and then outputs it directly via echo do_shortcode($shortcode) on line 393. When the input is not a valid WordPress shortcode (e.g., an HTML tag with JavaScript event handlers), do_shortcode() returns it unchanged, and it is reflected into the page without escaping. The endpoint is registered via admin_post_ (not admin_post_nopriv_), meaning it requires the user to be logged in with at minimum a Subscriber-level account. There is no nonce verification or additional capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute if they can successfully trick a user into performing an action such as clicking a link.

AnalysisAI

Reflected Cross-Site Scripting in WP Blockade - Visual Page Builder (all versions through 0.9.14) allows authenticated attackers holding at minimum a WordPress Subscriber-level account to inject arbitrary JavaScript into pages rendered in a victim's browser. The vulnerability exists in the render_shortcode_preview() function, which passes raw GET input through do_shortcode() without sanitization or output escaping - when the input is not a recognized shortcode, WordPress returns it verbatim, causing any embedded script to execute. Exploitation requires social engineering an authenticated user (e.g., an admin) into clicking a crafted link, but the low barrier to entry (Subscriber-level account) significantly widens the attacker pool on multi-user WordPress installations. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The affected component is the render_shortcode_preview() AJAX callback in wp-blockade.php, registered via WordPress's admin_post_ hook (line 360 per Trac references), which restricts the endpoint to logged-in users only. At line 393, the function reads $_GET['shortcode'], applies stripslashes() - a data-cleaning function, not a security sanitizer - and passes the result directly to do_shortcode() before echoing the output. WordPress's do_shortcode() is designed to process registered shortcode tags; when it receives unrecognized input such as raw HTML with JavaScript event handlers (e.g., <img src=x onerror=alert(1)>), it returns the input unchanged. Because no output escaping (e.g., esc_html()) is applied before echo, the raw input is reflected into the HTTP response. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the reflected subtype. The absence of nonce verification means there is no CSRF token check that could otherwise partially limit exploitation. CPE: cpe:2.3:a:burlingtonbytes:wp_blockade_-_visual_page_builder:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patched version has been identified in the available intelligence at time of analysis; the Trac references point only to the vulnerable 0.9.14 tag and trunk without evidence of a subsequent fix commit or tagged release. Site administrators should monitor the WordPress.org plugin page and Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/66950509-ce2a-42fe-a8b2-2a92a1b573c3) for a patched release and upgrade immediately upon availability. As a compensating control, if the shortcode preview functionality is not actively used, deactivating or removing the WP Blockade plugin eliminates the attack surface entirely with no side effects beyond losing the visual page builder feature. Alternatively, restricting access to the WordPress admin_post_ endpoint for Subscriber-level users via a WAF rule targeting the render_shortcode_preview action would prevent exploitation while preserving higher-privilege admin use; note this is non-trivial to implement correctly without breaking legitimate admin functionality. On sites with open user registration, disabling open registration to prevent unauthorized Subscriber account creation raises the practical exploitation bar.