Description
The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the user supplied 'title' attribute in the mfd_shortcode() function, which is concatenated directly into the HTML output within a <caption> element. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-05-27
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Mutual Funds Data WordPress plugin contains a stored cross‑site scripting flaw in the mfd_shortcode() function. The "title" attribute supplied to the shortcode is concatenated directly into a <caption> element without input sanitization or output escaping. As a result, authenticated users with Contributor or higher roles can store arbitrary client‑side scripts that will execute on the page whenever any visitor loads it.

Affected Systems

This vulnerability affects the Mutual Funds Data plugin for WordPress versions up to and including 1.2.1. Any WordPress installation that has installed this plugin and grants Contributor or higher permissions to users is potentially exploitable.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. Attackers need only Contributor‑level access; once a malicious title is stored, any user who views the affected page will have the injected script executed. The risk is significant for sites that provide Contributor access to untrusted or external users.

Generated by OpenCVE AI on May 27, 2026 at 07:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Mutual Funds Data plugin to a version newer than 1.2.1 that fixes the XSS flaw.
  • If an update is not possible, disable the mfd_shortcode() function or remove the plugin entirely to prevent injection of malicious content.
  • Ensure that only trusted personnel are assigned the Contributor role or higher, and audit role permissions to limit the ability to insert or edit shortcodes containing the "title" attribute.

Generated by OpenCVE AI on May 27, 2026 at 07:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 27 May 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 27 May 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Mutualfunddata
Mutualfunddata mutual Funds Data
Wordpress
Wordpress wordpress
Vendors & Products Mutualfunddata
Mutualfunddata mutual Funds Data
Wordpress
Wordpress wordpress

Wed, 27 May 2026 06:30:00 +0000

Type Values Removed Values Added
Description The Mutual Funds Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' shortcode attribute in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping on the user supplied 'title' attribute in the mfd_shortcode() function, which is concatenated directly into the HTML output within a <caption> element. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Mutual Funds Data <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Mutualfunddata Mutual Funds Data
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-27T10:36:22.528Z

Reserved: 2026-05-18T20:19:53.418Z

Link: CVE-2026-8869

cve-icon Vulnrichment

Updated: 2026-05-27T10:36:17.499Z

cve-icon NVD

Status : Received

Published: 2026-05-27T07:16:16.347

Modified: 2026-05-27T07:16:16.347

Link: CVE-2026-8869

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-27T10:07:22Z

Weaknesses