What is the CVSS score of EUVD-2026-32077?

EUVD-2026-32077 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

BitForm Plugin EUVD-2026-32077

| CVE-2026-8891 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-fqhh-m4m2-4pc6

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:25 vuln.today

CVE Published

May 27, 2026 - 07:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The BitForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bitform' shortcode in versions up to, and including, 1.1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes ('width' and 'height') in the Shortcode::shortcode() function, which are interpolated directly into the 'style' attribute of an <iframe> element. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the BitForm WordPress plugin (versions up to and including 1.1.0) allows authenticated attackers with contributor-level access or above to inject persistent malicious scripts via unsanitized 'width' and 'height' shortcode attributes in the Shortcode::shortcode() function, which are written directly into the style attribute of an iframe element without escaping. Any user who subsequently views a page containing the injected shortcode will trigger execution of the attacker's script in their browser session, enabling session hijacking, credential theft, or malicious redirects. No public exploit code has been identified at time of analysis, and EPSS places current exploitation probability at 0.03% (9th percentile), indicating this is currently a low-activity finding despite its network-accessible attack vector.

Technical ContextAI

The BitForm plugin is a WordPress data-management and form-building solution. The vulnerable code resides in the Shortcode::shortcode() function within Common/Shortcode.php (lines 13 and 17 of the 1.1.0 tagged release), where user-supplied shortcode attribute values for 'width' and 'height' are interpolated without sanitization directly into the inline style attribute of an HTML iframe element. This falls squarely under CWE-79 (Improper Neutralization of Input During Web Page Generation / Stored XSS): user-controlled data is rendered back to the browser without proper encoding or allowlisting. The Scope:Changed (S:C) component of the CVSS vector confirms that the malicious script executes in the victim's browser security context rather than the originating application context, which is the defining characteristic of cross-site scripting. The affected component is further referenced in index.php line 54, suggesting the shortcode registration itself may contribute to the attack surface.

RemediationAI

No vendor-released patch version was identified in the available data at time of analysis; the NVD references point only to the vulnerable 1.1.0 source tree and do not reference a patched release. Site administrators should consult the WordPress plugin repository for BitForm and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/71167dec-38ec-4eb3-8fab-25eca0f8b071?source=cve for the latest patch status. As a compensating control, restrict contributor account creation and audit existing contributor-level accounts, as this entirely eliminates the PR:L attack vector. Disabling the 'bitform' shortcode via a shortcode blacklist plugin (e.g., Disable Gutenberg or a custom mu-plugin calling remove_shortcode('bitform')) prevents exploitation without removing the plugin, though this disables BitForm form rendering site-wide. Implementing a Web Application Firewall rule to strip or block CSS injection patterns in POST bodies targeting shortcode parameters can provide partial defense but is not a substitute for patching.