What is the CVSS score of EUVD-2026-32118?

EUVD-2026-32118 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Github Shortcode EUVD-2026-32118

| CVE-2026-8042 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-frqx-qv54-hjvh

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:41 vuln.today

CVE Published

May 27, 2026 - 08:16 nvd

MEDIUM 6.4

DescriptionCVE.org

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Github Shortcode plugin for WordPress (all versions through 0.1) allows authenticated attackers with Contributor-level access to inject persistent malicious scripts via the 'repo' attribute of the 'github' shortcode. Any user who subsequently visits the injected page triggers execution of the attacker-controlled script in their browser context. No public exploit has been identified at time of analysis and EPSS places exploitation probability at 0.03% (9th percentile), though the low barrier to exploitation for any site permitting contributor accounts warrants attention.

Technical ContextAI

The vulnerability originates in githubshortcode.php at line 25, where the plugin registers a WordPress shortcode handler for [github] that accepts a 'repo' parameter. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied shortcode attribute values are neither sanitized on input nor escaped on output before being rendered into the HTML page. Because WordPress shortcodes are processed server-side and their output is persisted in post content, any injected script payload survives across page loads and executes in the DOM context of every subsequent visitor. The changed scope (S:C in the CVSS vector) reflects this cross-user impact: the attacker's session is distinct from the victim's session, yet the injected code executes in the victim's browser with the victim's privileges.

RemediationAI

No vendor-released patch has been identified in the available data at time of analysis; the Wordfence threat intelligence entry (https://www.wordfence.com/threat-intel/vulnerabilities/id/c6848b7a-d869-41e7-9f33-01a35b6d4822) should be monitored for patch availability. Until a fix is confirmed, the most effective compensating control is to deactivate or uninstall the Github Shortcode plugin entirely, eliminating the vulnerable shortcode handler. If the plugin's functionality is required, restrict the Contributor role to fully trusted users only and audit existing contributor accounts - this limits the attacker population to trusted parties. A web application firewall rule blocking shortcode attributes containing script tags or event handler patterns (onerror, onload, javascript:) can add a detection layer but carries a risk of false positives on legitimate content. Disabling the specific shortcode via code filter (remove_shortcode('github')) is a surgical option that preserves the plugin installation while neutering the vulnerable entry point.