CVE-2026-39071CWE-79cross-site-scripting

CVE-2026-39071

Medium · published August 29, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-29T00:17Z
References (2)
https://github.com/tw181802/CVES/ · [email protected]https://github.com/tw181802/CVES/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:17Z
    EPSS moved — → 0%
    epss
  • 28 AUG 00:00Z
    WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field
    cvelistv5