Intel

CVE-2026-5341

Das NMR Strava Aktivitäten-Plugin für WordPress ist anfällig für Persistente Cross-Site Scripting-Angriffe über das Shortcode `strava_nmr…

mediumEPSS 0.4%

Description

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr_connect` shortcode in all versions up to, and including, 1.0.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: cvelistv5CVE.org (MITRE)ENISA EUVD

Metrics

XIEM Effective CVSS
6.4
Source: nvd-v3
EPSS percentile
26.5 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
55.62
Exploit maturity
no public PoC known
CVSS v3
6.4
EPSS score
0.4 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-05-08 09:26 UTC
CWE
CWE-79

Weakness classes (CWE)

  • CWE-79Base

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

    cwe.mitre.org →

References & sources