What is the CVSS score of CVE-2026-3368?

CVE-2026-3368 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-3368?

A stored cross-site scripting vulnerability in the Injection Guard WordPress plugin (versions ≤1.2.9) allows unauthenticated attackers to inject malicious code that executes when administrators…

How to fix or mitigate CVE-2026-3368?

Within 24 hours: Immediately disable the Injection Guard plugin on all WordPress instances and assess whether it is business-critical. Within 7 days: Review administrator access logs for suspicious activity and audit all administrator accounts for unauthorized changes. Within 30 days: Either replace the plugin with a patched alternative or maintain it in a disabled state until a security patch is released by the vendor.

PHP CVE-2026-3368

EUVD-2026-13918 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

WordPress PHP XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13918

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

HIGH 7.2

DescriptionCVE.org

The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up to and including 1.2.9. This is due to insufficient input sanitization in the sanitize_ig_data() function which only sanitizes array values but not array keys, combined with missing output escaping in the ig_settings.php template where stored parameter keys are echoed directly into HTML. When a request is made to the site, the plugin captures the query string via $_SERVER['QUERY_STRING'], applies esc_url_raw() (which preserves URL-encoded special characters like %22, %3E, %3C), then passes it to parse_str() which URL-decodes the string, resulting in decoded HTML/JavaScript in the array keys. These keys are stored via update_option('ig_requests_log') and later rendered without esc_html() or esc_attr() on the admin log page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in the admin log page that execute whenever an administrator views the Injection Guard log interface.

AnalysisAI

The Injection Guard plugin for WordPress versions up to 1.2.9 contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious JavaScript into the admin log interface. The flaw stems from insufficient sanitization of query parameter names, which are logged and later rendered without proper output escaping when administrators view the plugin's log page. This enables arbitrary script execution in the context of an authenticated administrator's browser session, potentially leading to account compromise or further malicious actions.

Technical ContextAI

This vulnerability affects the Injection Guard WordPress plugin (CPE: cpe:2.3:a:fahadmahmood:injection_guard:*:*:*:*:*:*:*:*) and is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation). The plugin captures incoming requests via $_SERVER['QUERY_STRING'], applies esc_url_raw() which preserves URL-encoded special characters, then uses parse_str() to decode the query string into an array. The sanitize_ig_data() function only sanitizes array values but ignores array keys, allowing attackers to craft malicious query parameter names containing HTML or JavaScript. These unsanitized keys are stored via update_option('ig_requests_log') and later echoed directly in ig_settings.php (lines 120, 121, 124) without esc_html() or esc_attr() output escaping, resulting in stored XSS when administrators view the log interface.

RemediationAI

WordPress site administrators should immediately upgrade the Injection Guard plugin to a patched version beyond 1.2.9 if available, checking the official WordPress plugin repository or the vendor's release notes. Until a patch is applied, administrators should consider temporarily disabling the Injection Guard plugin or restricting access to its admin log interface to only trusted administrators via WordPress role capabilities. As a defense-in-depth measure, implement Content Security Policy (CSP) headers to mitigate XSS impact by restricting script execution to trusted sources. Review existing log entries in the Injection Guard interface for suspicious query parameter names containing HTML/JavaScript syntax before an administrator inadvertently triggers stored payloads. Additional technical details and source code references are available at https://plugins.trac.wordpress.org/browser/injection-guard/ for security teams conducting impact assessment.