What is the CVSS score of EUVD-2026-32176?

EUVD-2026-32176 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

myLinksDump EUVD-2026-32176

| CVE-2026-2288 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-27 security@wordfence.com

GHSA-9cp7-jx4p-7q69

XSS WordPress

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 22:22 vuln.today

CVE Published

May 27, 2026 - 11:16 nvd

MEDIUM 4.8

DescriptionCVE.org

The myLinksDump plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_title' parameter in all versions up to, and including, 1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored Cross-Site Scripting in the myLinksDump WordPress plugin (all versions ≤1.6) allows authenticated administrators to permanently inject arbitrary JavaScript into pages via the unsanitized 'link_title' parameter, executing in any victim's browser upon page access. Exploitation is constrained to WordPress multi-site environments or single-site installs with unfiltered_html disabled, and requires administrator-level credentials plus victim interaction. EPSS is 0.03% (9th percentile) and SSVC confirms no known exploitation, placing this firmly in a low-priority tier despite the stored XSS class.

Technical ContextAI

The vulnerability resides in the myLinksDump WordPress plugin at two code locations within myLinksDump.php (lines 325 and 557), where the 'link_title' parameter is neither properly sanitized on input nor escaped on output, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). WordPress's unfiltered_html capability normally permits administrators to post raw HTML, which masks this class of defect in standard single-site installs; however, multi-site networks and hardened installs where unfiltered_html is explicitly disabled do not grant this bypass, exposing the flaw. The CVSS scope flag S:C (Changed) reflects that the injected script executes in the browser context of affected end users, crossing the trust boundary from the admin panel to the broader site audience.

RemediationAI

No vendor-released patched version has been identified at time of analysis - references in the NVD record point only to the vulnerable 1.6 tag and current trunk, with no tagged fix release present. Administrators should disable or remove the myLinksDump plugin until an updated version is published. As a compensating control, enabling the unfiltered_html capability for administrators on single-site installs will neutralize this specific vector, though this trade-off grants broader HTML posting rights and may not be acceptable in hardened environments. On multi-site networks where unfiltered_html cannot be re-enabled, the only safe option is deactivation. Monitor the plugin's Trac page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/efd18739-3cd1-486c-9587-8deba5a0940e?source=cve) for patch availability. Restricting the administrator role to fully trusted users reduces the risk surface in the interim.