What is the CVSS score of CVE-2026-3347?

CVE-2026-3347 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3347?

Organizations using all should be aware of moderate risk from CVE-2026-3347, a cross-site scripting vulnerability rated CVSS 5.5.

How to fix or mitigate CVE-2026-3347?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3347

EUVD-2026-14175 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-687q-32c6-8x68

GHSA-gv9p-wq55-477w

GHSA-p747-qc5p-773r

GHSA-wc83-79hj-hpmq

GHSA-xggw-g9pm-9qhh

WordPress XSS

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14175

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 5.5

DescriptionCVE.org

The Multi Functional Flexi Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the arv_lb[message] parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This is due to the arv_lb_options_val() sanitize callback returning user input without any sanitization, and the stored message value being output in the genLB() function without escaping. This makes it possible for authenticated attackers, with Administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page or post with the lightbox enabled.

AnalysisAI

A Stored Cross-Site Scripting vulnerability exists in the Multi Functional Flexi Lightbox WordPress plugin (versions up to and including 1.2) that allows authenticated administrators to inject arbitrary JavaScript code via the arv_lb[message] parameter. The vulnerability stems from insufficient input sanitization in the arv_lb_options_val() callback function and missing output escaping in the genLB() function, enabling malicious scripts to execute in the browsers of any user viewing pages or posts with the lightbox enabled. With a CVSS score of 5.5 and requiring high-privilege administrator access, this represents a moderate but real risk primarily applicable to compromised or malicious admin accounts.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) affecting the Multi Functional Flexi Lightbox plugin for WordPress (identified via CPE cpe:2.3:a:arevico:multi_functional_flexi_lightbox:*:*:*:*:*:*:*:*). The root cause involves two distinct coding failures: the arv_lb_options_val() sanitization callback in options.php (line 94) accepts user input without any sanitization, and the genLB() function in sp.php (line 37) outputs the stored message parameter without HTML escaping. WordPress plugin architecture relies on the options API and sanitization/escaping hooks to prevent such vulnerabilities, and the plugin's failure to properly implement these security mechanisms creates a direct pathway for script injection that persists in the WordPress database and executes in the context of all page visitors.

RemediationAI

Site administrators should immediately deactivate and remove the Multi Functional Flexi Lightbox plugin until a patched version is released, or upgrade to a version beyond 1.2 once available from the plugin author. Until a vendor fix is released, restrict administrator account access to trusted users only and implement strong authentication measures (multi-factor authentication) for all WordPress administrator accounts to prevent unauthorized modifications to plugin settings. Monitor WordPress database tables (wp_options) for suspicious stored values in the arv_lb_options serialized data and review page/post content for unexpected JavaScript embedded in lightbox message parameters. Enable WordPress security plugins with XSS detection capabilities to provide additional defense-in-depth monitoring, and consider using a Web Application Firewall (WAF) to detect and block reflected/stored XSS patterns in administrator requests. Refer to the Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a4c0b14a-d039-4008-a433-ab3605e2612c?source=cve for updates on patch availability.