PatchSiren cyber security CVE debrief
CVE-2026-8038 mcinvale CVE debrief
The Faces of Users WordPress plugin (versions ≤0.0.3) contains a stored cross-site scripting (XSS) vulnerability in the 'facesofusers' shortcode's 'default' attribute. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. These scripts execute when any user accesses an injected page. The vulnerability was disclosed on 2026-05-20 with a CVSS 3.1 score of 6.4 (Medium severity). No patch is currently available; the plugin repository shows version 0.0.3 as the latest tagged release and trunk remains unpatched at the same vulnerable line.
- Vendor
- mcinvale
- Product
- Faces of Users
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-20
- Original CVE updated
- 2026-05-20
- Advisory published
- 2026-05-20
- Advisory updated
- 2026-05-20
Who should care
WordPress site administrators, security teams managing WordPress installations, and organizations with Contributor or Author role users who may have access to content editing capabilities.
Technical summary
The Faces of Users plugin registers a shortcode handler that directly outputs user-supplied input from the 'default' attribute without sanitization or escaping. The vulnerable code path is located at line 62 in faces-of.php. An attacker with Contributor privileges can craft a post or page containing the shortcode with a malicious payload in the default attribute (e.g., [facesofusers default='...']). When the post is published and viewed, the payload executes in the browser context of any visitor. The vulnerability affects all versions up to and including 0.0.3; no patched version exists as of the disclosure date.
Defensive priority
medium
Recommended defensive actions
- Audit WordPress installations for the Faces of Users plugin; remove or disable if present until a patched version is released.
- Implement Content Security Policy (CSP) headers to mitigate impact of potential XSS payloads.
- Restrict Contributor and Author role assignments to trusted users only; consider using role management plugins to disable unfiltered_html capability where feasible.
- Monitor for unexpected shortcode usage in post_content and postmeta database tables.
- Subscribe to Wordfence threat intelligence or plugin security advisories for patch availability notifications.
Evidence notes
Vulnerability confirmed via Wordfence advisory and WordPress plugin repository source code review. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as primary weakness. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Official resources
2026-05-20