What is the CVSS score of CVE-2026-3362?

CVE-2026-3362 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Short Comment Filter CVE-2026-3362

EUVD-2026-24642 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-22 Wordfence

GHSA-39pg-69jq-6vx9

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 22, 2026 - 10:01 vuln.today

EUVD ID Assigned

Apr 22, 2026 - 08:30 euvd

EUVD-2026-24642

Analysis Generated

Apr 22, 2026 - 08:30 vuln.today

CVE Published

Apr 22, 2026 - 07:45 nvd

MEDIUM 4.4

DescriptionCVE.org

The Short Comment Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Minimum Count' settings field in all versions up to and including 2.2. This is due to insufficient input sanitization (no sanitize callback on register_setting) and missing output escaping (no esc_attr() on the echoed value in the input's value attribute). The option value is stored via update_option() and rendered unescaped in an HTML attribute context. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in the settings page that will execute whenever a user accesses that page. This is particularly impactful in WordPress multisite installations or when DISALLOW_UNFILTERED_HTML is set, where administrators are not granted the unfiltered_html capability.

AnalysisAI

Stored Cross-Site Scripting in Short Comment Filter WordPress plugin up to version 2.2 allows authenticated administrators to inject arbitrary JavaScript through the 'Minimum Count' settings field due to missing input sanitization and output escaping. The vulnerability affects all versions through 2.2 and has particular impact in WordPress multisite environments or when DISALLOW_UNFILTERED_HTML is configured, where administrators lack unfiltered_html capabilities. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The Short Comment Filter plugin registers a settings option without a sanitize callback via register_setting(), allowing arbitrary data to be stored in the WordPress options table. The stored value is later rendered in an HTML attribute context (the value attribute of an input field) without using WordPress escaping functions like esc_attr(). This combination of missing sanitization on input and missing escaping on output creates a Stored XSS vulnerability (CWE-79) where malicious scripts persist in the database and execute in the browser of any user accessing the settings page. The vulnerability specifically affects the settings.php view file at line 25 and the short-comment-filter-settings.php class file where the option is registered and rendered.

RemediationAI

Upgrade Short Comment Filter to a patched version released after 2.2 that includes proper input sanitization via a sanitize callback on register_setting() and output escaping using esc_attr() in the settings.php template. Until an official patch is available, administrators should restrict access to the plugin settings page to trusted users only by implementing role-based access controls or disabling the plugin entirely if not actively used. Organizations managing multisite installations should review which site administrators have access to plugin settings and consider network-level restrictions on untrusted installations. Wordfence has published detailed vulnerability information at https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba46475-bf54-49a8-9b0e-fae3fb4e1df9 with additional context on mitigation strategies.