Stored Cross-Site Scripting in Next Date Plugin for WordPress
CVE-2026-4920

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Next Date
Vendor
CVE Published:
12 May 2026

What is CVE-2026-4920?

The Next Date plugin for WordPress suffers from a vulnerability that allows stored cross-site scripting (XSS) attacks. This issue arises from inadequate input sanitization and output escaping related to the 'default' shortcode attribute. Authenticated attackers with contributor-level access can exploit this flaw, enabling them to inject arbitrary web scripts into pages. When users access the compromised pages, the injected scripts are executed, potentially leading to unauthorized actions and data theft.

Affected Version(s)

Next Date 0 <= 1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/nextdate/tags/...
https://plugins.trac.wordpress.org/browser/nextdate/trunk...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Djaidja Moundjid
.