PT-2026-38903 · WordPress · Nmr Strava Activities

Djaidja Moundjid · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-5341

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions NMR Strava activities plugin for WordPress versions prior to 1.0.15

Description Insufficient input sanitization and output escaping on user supplied attributes in the strava nmr connect shortcode allow authenticated attackers with contributor-level access and above to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the injected content. This is a Stored Cross-Site Scripting issue, where malicious scripts are permanently stored on the target server.

Recommendations Update the plugin to a version later than 1.0.14. As a temporary workaround, restrict the use of the strava nmr connect shortcode to trusted users with higher privilege levels.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5341

Affected Products

Nmr Strava Activities

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-5341 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3524779%40nmr-strava-activities%2Ftrunk&old=3520018%40nmr-strava-activities%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://t.me/cveNotify/162692 · Telegram Post
• https://plugins.trac.wordpress.org/browser/nmr-strava-activities/tags/1.0.14/nmr-strava-activities.php#L259 · Note
• https://twitter.com/CVEnew/status/2053174684305248413 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2052737585575858177 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7e033919-ca00-4789-8635-b4189e1499ef?source=cve · Note
• https://t.me/CVEtracker/53108 · Telegram Post
• https://plugins.trac.wordpress.org/browser/nmr-strava-activities/tags/1.0.15/nmr-strava-activities.php#L240 · Note
• https://plugins.trac.wordpress.org/browser/nmr-strava-activities/tags/1.0.15/nmr-strava-activities.php#L251 · Note
• https://plugins.trac.wordpress.org/browser/nmr-strava-activities/tags/1.0.14/nmr-strava-activities.php#L247 · Note