What is the CVSS score of EUVD-2026-32750?

EUVD-2026-32750 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Shariff Wrapper EUVD-2026-32750

| CVE-2026-4334 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-28 Wordfence

GHSA-xp36-f956-vp7p

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 09:23 vuln.today

CVE Published

May 28, 2026 - 08:27 nvd

MEDIUM 6.4

DescriptionCVE.org

The Shariff Wrapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headline' parameter in the [shariff] shortcode in all versions up to, and including, 4.6.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability occurs because the plugin uses a custom wp_kses implementation with permissive allowed HTML tags, and then performs a str_replace operation that injects HTML after sanitization, allowing event handlers to be introduced through the %total placeholder in the style attribute.

AnalysisAI

Stored Cross-Site Scripting in the Shariff Wrapper WordPress plugin (all versions ≤ 4.6.20) allows authenticated Contributors to inject persistent JavaScript payloads via the 'headline' parameter of the [shariff] shortcode, which then execute in any visitor's browser upon page load. The Changed scope (S:C in CVSS) means the injected payload escapes the plugin's context and runs inside victim browsers across the full WordPress front-end, enabling session theft, credential harvesting, or drive-by redirection. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the low attack complexity and persistent nature of stored XSS make it a meaningful risk on multi-author or open-registration WordPress installations.

Technical ContextAI

The Shariff Wrapper plugin (CPE: cpe:2.3:a:3uu:shariff_wrapper:*:*:*:*:*:*:*:*, vendor: 3uu) is a WordPress social sharing button plugin that processes the [shariff] shortcode. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS), arising from a flawed sanitization pipeline. The plugin applies a custom wp_kses implementation with a permissive allowed HTML tag list to the 'headline' parameter, but then performs a str_replace operation on the already-sanitized output to substitute the %total placeholder inside a style attribute. Because str_replace runs after sanitization, it can reintroduce HTML event handlers (e.g., onerror=, onmouseover=) that the sanitizer never evaluated. The vulnerable logic is traceable to shariff.php at lines 868, 965, 1143, and 1144 per the WordPress plugin trac references supplied in the advisory. This is a classic post-sanitization injection pattern, where the developer assumed sanitization was a terminal step rather than accounting for subsequent content transformation.

RemediationAI

Update the Shariff Wrapper plugin to the version corresponding to or superseding trac changeset revision 3532532, available through the WordPress plugin repository. The exact patched release version tag is not independently confirmed from the available data - consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e037d22a-3d4d-4f70-a749-6d6c552c7553 for the confirmed fixed release once published. As an interim compensating control, restrict Contributor-level account creation and audit existing Contributor accounts for unauthorized access - note this may impact legitimate editorial workflows. Alternatively, disable the Shariff Wrapper plugin entirely until patching is confirmed; this eliminates the attack surface but removes social sharing functionality site-wide. WordPress administrators can also use a Web Application Firewall rule (e.g., Wordfence WAF) to block shortcode parameter injection patterns targeting the headline attribute as a temporary measure, though WAF rules carry a risk of false positives on legitimate content.