What is the CVSS score of EUVD-2026-35299?

EUVD-2026-35299 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

BMI Calculator EUVD-2026-35299

| CVE-2026-8883 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-3xrw-mxp7-2r3j

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:16 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.4

DescriptionCVE.org

The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the GBMI_Calc_Widget::widget() function. Shortcode attributes are extracted directly into local variables via @extract($args) and then echoed unescaped into an HTML style attribute (height/width) and HTML body context (title), allowing attribute-breakout payloads. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the Global Body Mass Index Calculator WordPress plugin (versions up to and including 1.2) allows authenticated contributors to persistently inject arbitrary JavaScript into any page rendering the 'gbmicalc' shortcode. The vulnerability arises from PHP's @extract() call on unsanitized shortcode attributes followed by unescaped output into both an HTML style attribute context and an HTML body context inside GBMI_Calc_Widget::widget(), enabling attribute-breakout payloads. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the Wordfence-confirmed contributor-level requirement makes this a realistic risk for any multi-author WordPress installation.

Technical ContextAI

The affected component is the GBMI_Calc_Widget::widget() function within the Global Body Mass Index Calculator WordPress plugin, developed by vendor 'helpstring' (CPE: cpe:2.3:a:helpstring:global_body_mass_index_calculator:*:*:*:*:*:*:*:*). The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). PHP's @extract($args) extracts all shortcode attributes directly into local variable scope without any sanitization step; those variables are subsequently echoed unescaped into an HTML style attribute controlling height and width values (gbmicalc.php lines ~335 and ~345) and into an HTML body context for the title parameter (line ~476). The style-attribute injection context enables attribute-breakout payloads - for example, a closing quote followed by an event handler - while the title context permits direct script-tag injection. CVSS scope is rated S:C (Changed) because the stored script executes in the victim's browser security context rather than the attacker's, crossing the trust boundary from the contributor's session into that of any subsequent page visitor.

RemediationAI

No vendor-released patch has been identified at time of analysis - all source code references point exclusively to the vulnerable 1.2 release, and no later tagged version appears in the plugin repository. The primary remediation is to deactivate or uninstall the Global Body Mass Index Calculator plugin immediately; this eliminates the attack surface entirely at the cost of the BMI calculator functionality on affected pages. If deactivation is operationally infeasible, restrict contributor-role assignment to fully trusted users only, since the attack requires at minimum that role - this limits exploitation to credentialed insiders and substantially reduces real-world risk, though it does not fix the underlying flaw. Deploying a Web Application Firewall with plugin-specific rules targeting 'gbmicalc' shortcode attribute injection patterns (Wordfence provides rule coverage for its advisory findings) offers partial mitigation with the caveat that WAF rules can be bypassed by sufficiently obfuscated payloads. Monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/06804bed-17c5-413c-a31b-f6f039015e26 for a patched release and apply it immediately upon availability.