What is the CVSS score of CVE-2026-3572?

CVE-2026-3572 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3572?

Organizations using iTracker360 should be aware of moderate risk from CVE-2026-3572, a cross-site scripting vulnerability rated CVSS 6.1.

How to fix or mitigate CVE-2026-3572?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery le and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

WordPress CVE-2026-3572

EUVD-2026-13925 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 Wordfence

WordPress XSS CSRF

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 23:46 euvd

EUVD-2026-13925

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:25 nvd

MEDIUM 6.1

DescriptionCVE.org

The iTracker360 plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in all versions up to and including 2.2.0. This is due to missing nonce verification on the settings form submission and insufficient input sanitization combined with missing output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request granted they can trick an administrator into performing an action such as clicking on a link.

AnalysisAI

The iTracker360 WordPress plugin (versions up to 2.2.0) contains a combined Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) vulnerability in its settings form submission handler. An unauthenticated attacker can craft a malicious link or webpage that, when clicked by an administrator, injects arbitrary JavaScript code into the plugin's stored settings due to missing nonce verification and insufficient input sanitization/output escaping. This vulnerability is classified as medium severity (CVSS 6.1) and poses a real risk to WordPress sites using this plugin, as exploitation requires only user interaction and network access with no special privileges.

Technical ContextAI

The iTracker360 plugin for WordPress (cpe:2.3:a:itracker360:itracker360:*:*:*:*:*:*:*:*) fails to implement nonce-based CSRF protection on admin settings forms, a WordPress best practice enforced via wp_verify_nonce(). The vulnerability roots in two CWE-79 (Improper Neutralization of Input During Web Page Generation) weaknesses: (1) missing nonce tokens that would validate form submissions originate from authenticated admin sessions, and (2) insufficient input sanitization on settings parameters combined with missing output escaping when rendering those settings. The referenced code locations (itracker360.php lines 115-116, 187 in both trunk and version 2.1.9) indicate the vulnerable form handler and settings retrieval/display code lack WordPress security functions like sanitize_text_field(), wp_kses_post(), or esc_attr().

RemediationAI

Update iTracker360 to version 2.2.1 or later, which should include nonce verification on all settings form submissions and proper input sanitization/output escaping. Until a patched version is released and deployed, site administrators should disable or remove the iTracker360 plugin entirely. As a temporary mitigation, restrict WordPress admin access via IP whitelisting or require authentication at the reverse proxy/web application firewall level, though this does not fully protect against CSRF attacks from admin-controlled networks. Monitor plugin changelogs at https://plugins.trac.wordpress.org/browser/itracker360/ and the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5ef842ad-3d23-4206-af3b-b3f55486766f for patch availability.