What is the CVSS score of CVE-2026-3512?

CVE-2026-3512 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3512?

Organizations using all should be aware of moderate risk from CVE-2026-3512, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-3512?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3512

EUVD-2026-12783 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-18 Wordfence

WordPress XSS

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 07:30 euvd

EUVD-2026-12783

Analysis Generated

Mar 18, 2026 - 07:30 vuln.today

CVE Published

Mar 18, 2026 - 06:48 nvd

MEDIUM 6.1

DescriptionCVE.org

The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0.1. This is due to insufficient input sanitization and output escaping in the bjl_wprintstylo_comments_nav() function. The function directly outputs the $_GET['p'] parameter into an HTML href attribute without any escaping. This makes it possible for authenticated attackers with Contributor-level permissions or higher to inject arbitrary web scripts in pages that execute if they can successfully trick another user into performing an action such as clicking on a link.

AnalysisAI

The Writeprint Stylometry WordPress plugin (versions up to 0.1) contains a Reflected Cross-Site Scripting (XSS) vulnerability in the bjl_wprintstylo_comments_nav() function that fails to properly sanitize and escape the 'p' GET parameter before outputting it in HTML href attributes. An attacker can craft a malicious link containing arbitrary JavaScript code and trick users into clicking it, resulting in session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction (clicking a link) but has a network attack vector with low complexity and no privilege requirements, making it a practical threat in WordPress ecosystems.

Technical ContextAI

The vulnerability is a classic Reflected XSS (CWE-79) in PHP-based WordPress plugin code. The affected product is the Writeprint Stylometry plugin (CPE: cpe:2.3:a:alhadeff:writeprint_stylometry:*:*:*:*:*:*:*:*) for WordPress. The root cause is that the bjl_wprintstylo_comments_nav() function directly concatenates the $_GET['p'] parameter into an HTML href attribute without using WordPress escaping functions such as esc_attr() or esc_url(). This allows attackers to break out of the attribute context and inject script tags or event handlers. The vulnerability exists in the plugin source code at lines 341 and 345 of writeprint-stylometry.php, as confirmed by multiple references to the WordPress plugin repository browser. The lack of input validation and output encoding against the GET parameter is the direct technical failure.

RemediationAI

Immediately deactivate and remove the Writeprint Stylometry plugin from all affected WordPress installations, as no patched version has been released and the vulnerability affects all versions up to 0.1. Consult the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5a614ce5-faa4-4b27-84bd-f15f8652d477 and the VULDB advisory at https://vuldb.com/?id.351502 for detailed remediation guidance. As a temporary measure before removal, restrict access to the plugin's functionality via .htaccess rules or a Web Application Firewall (WAF) to block requests containing the 'p' parameter with script-like payloads, though complete removal is strongly recommended. Additionally, audit WordPress access logs for any suspicious referrers or XSS payload patterns in the 'p' parameter to identify if the vulnerability has been exploited. Consider implementing a Content Security Policy (CSP) header to mitigate any reflected XSS that may have already executed.