What is the CVSS score of CVE-2026-2834?

CVE-2026-2834 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-2834?

Token of Trust WordPress plugin versions 3.32.3 and earlier contain a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts that persist in the…

How to fix or mitigate CVE-2026-2834?

Within 24 hours: disable or remove Token of Trust plugin versions ≤3.32.3 from all WordPress installations; audit plugin activity logs for suspicious description parameter submissions. Within 7 days: identify and assess alternative plugins for required functionality; implement Web Application Firewall (WAF) rules to filter malicious script injection in plugin parameters if removal is not operationally feasible. Within 30 days: verify all website users for unauthorized administrative accounts; conduct full security audit of stored data for injected scripts; document decision on permanent remediation path (plugin replacement or vendor confirmation of patch release).

WordPress CVE-2026-2834

EUVD-2026-22824 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-15 Wordfence

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 01:48 vuln.today

EUVD ID Assigned

Apr 15, 2026 - 01:45 euvd

EUVD-2026-22824

Analysis Generated

Apr 15, 2026 - 01:45 vuln.today

CVE Published

Apr 15, 2026 - 01:25 nvd

HIGH 7.2

DescriptionCVE.org

The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in Token of Trust WordPress plugin versions ≤3.32.3 allows unauthenticated remote attackers to inject malicious scripts via the unsanitized 'description' parameter, achieving persistent code execution in victim browsers with changed security context (CVSS scope changed). CVSS 7.2 with network attack vector and no authentication required. No public exploit identified at time of analysis, but EPSS data not provided to assess exploitation probability.

Technical ContextAI

This vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation) in the Age Verification & Identity Verification by Token of Trust WordPress plugin (cpe:2.3:a:tokenoftrust:age_verification_&_identity_verification_by_token_of_trust). The plugin fails to properly sanitize user-supplied input in the 'description' parameter before storing it in the database and rendering it in web pages. Unlike reflected XSS, stored XSS persists the malicious payload in the application's data store, causing it to execute repeatedly for all users viewing the affected page. The referenced source code in error-log.php and view-logs.php (versions 3.31.4) demonstrates inadequate output escaping when displaying user-controlled data. WordPress plugins commonly suffer from this vulnerability class when developers fail to use WordPress security functions like esc_html(), esc_attr(), or wp_kses() for output sanitization, or wp_unslash() and sanitize_text_field() for input validation.

RemediationAI

No vendor-released patch identified at time of analysis based on provided data. Site administrators should immediately check for plugin updates beyond version 3.32.3 in the WordPress plugin repository or contact Token of Trust directly for patch availability. As interim mitigation, consider temporarily disabling the plugin if age verification is non-critical, or implement Web Application Firewall (WAF) rules to filter potentially malicious input in the 'description' parameter. Review existing stored description fields for injected script tags using patterns like <script>, onerror=, onload=, and javascript: protocols. If continuing to use vulnerable versions, restrict plugin administrative access to trusted users only and monitor for unauthorized changes to description fields. Implement Content Security Policy (CSP) headers to limit inline script execution as defense-in-depth. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2d8e037e-c446-44ae-a5ee-bbba938e5edf?source=cve for updates on patch availability and additional mitigation guidance.