What is the CVSS score of CVE-2026-3353?

CVE-2026-3353 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3353?

Organizations using all should be aware of moderate risk from CVE-2026-3353, a cross-site scripting vulnerability rated CVSS 4.4.

How to fix or mitigate CVE-2026-3353?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3353

EUVD-2026-14164 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-21 Wordfence

GHSA-5j54-r8cm-hmwx

WordPress XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14164

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.4

DescriptionCVE.org

The Comment SPAM Wiper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' setting in all versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

The Comment SPAM Wiper plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the 'API Key' setting that allows authenticated administrators to inject arbitrary JavaScript code. This vulnerability affects multi-site WordPress installations and those with the unfiltered_html capability disabled, impacting versions up to and including 1.2.1. While the CVSS score of 4.4 is moderate and exploitation requires high-privilege access (Administrator level), the stored nature of the XSS means injected scripts execute for all users accessing affected pages, creating persistent exposure.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), specifically a Stored XSS flaw in the Comment SPAM Wiper plugin (CPE: cpe:2.3:a:intermod:comment_spam_wiper:*:*:*:*:*:*:*:*). The root cause is insufficient input sanitization and output escaping of the 'API Key' setting parameter, as evidenced by the vulnerable code path at /admin.php line 87 (confirmed in both trunk and version 1.2.1 releases via the WordPress plugin repository). The vulnerability is context-dependent, only manifesting in multi-site WordPress environments or single-site installations where the unfiltered_html capability has been explicitly disabled, which typically happens to restrict HTML/JavaScript privileges to non-administrator roles.

RemediationAI

Update the Comment SPAM Wiper plugin to a version beyond 1.2.1 that includes input sanitization and output escaping patches for the API Key setting. Administrators should review the plugin's security advisory or the WordPress plugin repository for the first patched version. Until a patch is available or deployed, restrict Administrator role access to trusted users only, implement regular access audits to detect unauthorized administrative accounts, and consider disabling the Comment SPAM Wiper plugin if it is not actively required. For multi-site installations, leverage WordPress role-based access controls to limit who can modify plugin settings, and monitor WordPress admin activity logs for suspicious API Key modifications.