CVE-2026-4082

OVERVIEW The ER Swiffy Insert plugin for WordPress versions up to 1.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in its [swiffy] shortcode implementation. The flaw exists in three shortcode attributes ('n', 'w', 'h') that are processed through the extract() function and directly output to HTML without proper escaping. This allows authenticated attackers with Contributor-level or higher permissions to inject malicious scripts into pages that execute when other users access the affected content. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) with a network attack vector, low complexity, and a requirement for low-level user privileges. The attack has cross-site scope with limited impacts to confidentiality and integrity, while availability is unaffected. The relatively low EPSS score of 0.00011 suggests minimal exploitation activity across the wider threat landscape, and the vulnerability does not appear on the CISA KEV catalog. EXPLOITATION STATUS Currently, there are no indicators of active exploitation or publicly available exploit code for this vulnerability. The vulnerability remains on the inactive Hot List with minimal community attention. The attack requires authenticated access and a motivated insider threat rather than external opportunistic exploitation, which likely explains the low current exploitation risk despite the vulnerability's presence in the WordPress plugin ecosystem.