EUVD-2026-24642
GHSA-39pg-69jq-6vx9
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability.
AnalysisAI
Stored Cross-Site Scripting in Short Comment Filter WordPress plugin up to version 2.2 allows authenticated administrators to inject arbitrary JavaScript through the 'Minimum Count' settings field due to missing input sanitization and output escaping. The vulnerability affects all versions through 2.2 and has particular impact in WordPress multisite environments or when DISALLOW_UNFILTERED_HTML is configured, where administrators lack unfiltered_html capabilities. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
The Short Comment Filter plugin registers a settings option without a sanitize callback via register_setting(), allowing arbitrary data to be stored in the WordPress options table. The stored value is later rendered in an HTML attribute context (the value attribute of an input field) without using WordPress escaping functions like esc_attr(). This combination of missing sanitization on input and missing escaping on output creates a Stored XSS vulnerability (CWE-79) where malicious scripts persist in the database and execute in the browser of any user accessing the settings page. The vulnerability specifically affects the settings.php view file at line 25 and the short-comment-filter-settings.php class file where the option is registered and rendered.
RemediationAI
Upgrade Short Comment Filter to a patched version released after 2.2 that includes proper input sanitization via a sanitize callback on register_setting() and output escaping using esc_attr() in the settings.php template. Until an official patch is available, administrators should restrict access to the plugin settings page to trusted users only by implementing role-based access controls or disabling the plugin entirely if not actively used. Organizations managing multisite installations should review which site administrators have access to plugin settings and consider network-level restrictions on untrusted installations. Wordfence has published detailed vulnerability information at https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9 with additional context on mitigation strategies.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today