What is the CVSS score of EUVD-2026-32064?

EUVD-2026-32064 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Shortcode Buddy EUVD-2026-32064

| CVE-2026-8897 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-f65p-m3pq-29cc

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:17 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Shortcode Buddy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 0.1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Shortcode Buddy WordPress plugin (all versions ≤ 0.1.9.5) allows authenticated attackers with contributor-level access to permanently embed arbitrary JavaScript into pages via unsanitized shortcode attributes, executing in any visitor's browser upon page load. The Changed scope (S:C) in the CVSS vector confirms the injected payload escapes the plugin's context and affects users browsing the site, including administrators whose sessions could be hijacked. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (9th percentile), indicating low observed exploitation probability, though the contributor-level entry bar makes this a realistic risk on sites with multiple editors.

Technical ContextAI

The vulnerability resides in the Shortcode Buddy plugin's shortcode rendering logic, specifically in shortcodes/shortcodes.php at lines 150 and 156 per the WordPress trac source references. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied shortcode attribute values are neither sanitized on input nor escaped on output before being rendered into the HTML page. WordPress shortcodes allow users with at minimum contributor access to embed dynamic content via bracket syntax; when the plugin processes those attributes and reflects them into page HTML without encoding, browser-executable script tags or event handler payloads survive into the rendered DOM. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C confirms this is a network-reachable, low-complexity attack that changes scope - meaning the impact crosses from the plugin's execution context into the victim user's browser session.

RemediationAI

No vendor-released patch version has been independently confirmed in the available data - the provided references link to Wordfence's advisory and WordPress trac source code but do not specify a remediated release version. Site administrators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2a5eeae6-313a-4244-9d6a-583828521a3b?source=cve and the WordPress plugin repository for an updated version exceeding 0.1.9.5. If no patched version is available, the most effective compensating control is to deactivate and remove the Shortcode Buddy plugin entirely, which eliminates the attack surface with no functional trade-off for sites that can substitute alternative shortcode management plugins. As a secondary control, restrict the contributor role from being granted to untrusted users until a patch is confirmed. Deploying a WordPress-aware WAF rule targeting shortcode attribute injection (Wordfence's firewall includes such rules for subscribers) can reduce exploitation risk but should not substitute for plugin removal or patching.