What is the CVSS score of EUVD-2026-38671?

EUVD-2026-38671 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

EntreDroppers EUVD-2026-38671

| CVE-2026-8628 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-24 Wordfence

GHSA-6p26-r96w-ch29

PHP WordPress XSS Wordpress Plugin Entredroppers

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

AV:N and PR:N reflect attacker perspective; UI:R is mandatory; S:C captures browser DOM cross-context impact; C:L/I:L reflect limited cookie/content exposure with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:02 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 6.1

DescriptionCVE.org

The EntreDroppers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PHP_SELF Parameter in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The payload is delivered via attacker-controlled path-info in the URL (e.g., /wp-admin/admin.php/"><script>alert(0)</script>/?page=EntreDroppers.php), which PHP_SELF reflects directly into the form action attribute.

AnalysisAI

Reflected Cross-Site Scripting in the EntreDroppers WordPress plugin (all versions through 1.1.2) allows unauthenticated attackers to inject arbitrary JavaScript into victim browsers by embedding script payloads in the URL path-info segment, which PHP reflects unsanitized through the PHP_SELF server variable into the form action attribute at EntreDroppers.php line 223. Successful exploitation requires tricking an authenticated WordPress administrator into clicking a crafted link pointing to the /wp-admin/ context, making this a social-engineering-dependent attack. No public exploit code or active exploitation has been identified at time of analysis; no patch has been confirmed from available data.

Technical ContextAI

PHP_SELF is a superglobal server variable that returns the path of the currently executing script, including any path-info appended to the URL after the script filename. When a request is made to /wp-admin/admin.php/<PAYLOAD>/?page=EntreDroppers.php, PHP populates PHP_SELF with the full path including the injected path-info. The plugin at EntreDroppers.php line 223 outputs this value directly into an HTML form action attribute without sanitization or HTML entity encoding, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). The Scope:Changed metric in the CVSS vector confirms the impact crosses from the server context into the victim's browser DOM. The affected product is identified by CPE cpe:2.3:a:owencutajar:entredroppers:*:*:*:*:*:*:*:*, covering all versioned releases through 1.1.2 as a WordPress plugin authored by owencutajar.

RemediationAI

No vendor-released patched version has been confirmed from available data - the Trac reference links to the trunk source but does not indicate a tagged fixed release. Site operators should consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/7fe4e182-5d0b-41da-8402-8b7de0b2c2e7?source=cve and the WordPress plugin repository for an updated version. As a compensating control, consider deactivating or removing the EntreDroppers plugin until a patched release is confirmed - this eliminates the attack surface with no functional trade-off beyond loss of the plugin's features. If the plugin must remain active, deploying a web application firewall rule that blocks path-info patterns containing angle brackets or script tags on /wp-admin/admin.php requests will reduce exposure, though WAF bypass is possible. Additionally, enforcing multi-factor authentication for all WordPress administrators raises the bar for attacker success since the victim must be an active wp-admin session holder.