What is the CVSS score of EUVD-2026-32063?

EUVD-2026-32063 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Team Master Plugin EUVD-2026-32063

| CVE-2026-8870 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-4v6q-v4j6-96rv

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:27 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Team Master - A Modern WordPress Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Team Master WordPress plugin (all versions ≤ 1.1.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via shortcode attributes into WordPress pages, executing against any visitor who subsequently loads the affected page. The scope change (S:C in CVSS) reflects cross-session impact - a low-privileged contributor can compromise higher-privileged users including administrators. No public exploit identified at time of analysis, and EPSS of 0.03% (9th percentile) indicates low current exploitation probability.

Technical ContextAI

The vulnerability resides in the plugin's shortcode rendering logic, specifically in team-master-public-shortcode.php at line 106, where user-supplied shortcode attribute values are passed into HTML output without adequate sanitization or escaping. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause: the plugin fails to apply functions such as esc_attr() or esc_html() to shortcode parameters before rendering them into the DOM. WordPress shortcodes are bracket-notation macros embedded in post content; contributor-role users have sufficient permissions to author posts containing shortcodes, making this the trust boundary violation. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects network-reachable exploitation with low complexity, requiring only contributor credentials, with scope crossing into victim browser sessions.

RemediationAI

No vendor-released patched version is independently confirmed from the available input data - the references point to the vulnerable source file on the WordPress plugin Trac browser and the Wordfence advisory, neither of which specifies an exact fix version. Site administrators should check the WordPress plugin repository for a version newer than 1.1.2 and upgrade immediately if available. As a compensating control, restrict the Contributor role from being assigned to untrusted users, or use a capability management plugin to remove shortcode rendering permissions from contributors - note this may impact legitimate content workflows. Additionally, deploying a Web Application Firewall rule targeting XSS payloads in WordPress shortcode parameters (Wordfence's own firewall covers this class of vulnerability) provides a meaningful layer of defense. Disabling the Team Master plugin entirely until a confirmed patched version is released is the lowest-risk option for high-sensitivity environments.