{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5508", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-03T16:49:06.144Z", "datePublished": "2026-04-08T06:43:40.553Z", "dateUpdated": "2026-04-08T17:05:25.368Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:25.368Z"}, "affected": [{"vendor": "theyeti", "product": "WowPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/893fa8c6-dcb4-4613-a836-8c717f859696?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wowpress/tags/1.0.0/wowpress.php#L22"}, {"url": "https://plugins.trac.wordpress.org/browser/wowpress/trunk/wowpress.php#L22"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2026-04-07T17:36:55.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:59:59.868395Z", "id": "CVE-2026-5508", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:00:14.328Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:59:59.868395Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T16:00:10.419Z"}}], "cna": {"title": "WowPress <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "theyeti", "product": "WowPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-04-07T17:36:55.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/893fa8c6-dcb4-4613-a836-8c717f859696?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wowpress/tags/1.0.0/wowpress.php#L22"}, {"url": "https://plugins.trac.wordpress.org/browser/wowpress/trunk/wowpress.php#L22"}], "descriptions": [{"lang": "en", "value": "The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T06:43:40.553Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5508", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:00:14.328Z", "dateReserved": "2026-04-03T16:49:06.144Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T06:43:40.553Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WowPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `wowpress` shortcode in all versions up to, and including, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2026-5508", "lastModified": "2026-04-08T21:26:35.910", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-08T07:16:23.367", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wowpress/tags/1.0.0/wowpress.php#L22"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wowpress/trunk/wowpress.php#L22"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/893fa8c6-dcb4-4613-a836-8c717f859696?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WowPress", "source": "cna", "vendor": "theyeti"}, "product": "wowpress", "vendor": "theyeti"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T08:52:27.555635+00:00", "value": {"mitigation_remediation": ["Apply the latest patch for WowPress by upgrading to a version newer than 1.0.0 as soon as it becomes available", "If an upgrade is not yet feasible, temporarily remove or disable the WowPress plugin to eliminate the attack surface", "Restrict contributor-level and higher roles from adding or editing content that includes the wowpress shortcode", "Search the site for pages that contain the malicious shortcode, remove any injected scripts, and verify that no other content has been compromised", "Review other active plugins for similar unsanitized shortcode attribute vulnerabilities and apply necessary updates or workarounds"], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "All releases of the WowPress plugin from the vendor theyeti up to and including version 1.0.0 are affected. WordPress sites that incorporate the wowpress shortcode in any of these versions are at risk.", "description_and_impact": "The WowPress plugin for WordPress contains a stored cross\u2011site scripting flaw in its wowpress shortcode. Because the plugin fails to properly sanitize and escape attributes supplied by users, an attacker who can create or edit content with contributor-level access or higher can embed arbitrary JavaScript into a shortcode. When other users view pages that contain the maliciously altered shortcode, the injected script is executed in their browsers, allowing attackers to steal credentials, hijack sessions, or deface content. The weakness is identified as CWE\u201179, reflecting a classic input validation error.", "risk_and_exploitability": "The base score of 6.4 indicates moderate severity. No external exploitation probability data is available, suggesting a medium likelihood of attack. The vulnerability is not listed in the known exploited vulnerabilities catalog, but because it can execute arbitrary code in users\u2019 browsers, the risk remains significant for sites that allow contributors or higher roles to edit content containing the shortcode. Attacks would require authenticated access that grants the ability to add or modify the shortcode attributes."}}}}, "created": "2026-04-08T19:31:07.828966+00:00", "updated": "2026-04-08T19:43:41.234164+00:00", "vendors": ["theyeti", "theyeti$PRODUCT$wowpress", "wordpress", "wordpress$PRODUCT$wordpress"]}